The Case for Greater Cyber Security Expertise on Corporate Boards

A series of new laws and regulations will transform the impact cyber risk and cyber security have on a company’s financial health. And companies must adjust their understanding of cyber risk analytics to protect their financial well-being.

As a starting point, companies need to re-examine their in-house cyber security expertise and increase the knowledge of senior management and boards of directors in regard to cyber security issues.

Earlier this year the Cyber Incident Reporting for Critical Infrastructure Act was signed into law. The act requires companies in broadly defined ‘critical infrastructure’ sectors to report notable cyberattacks and ransomware payments to the Cyber security and Infrastructure Security Agency (CISA) within 24 to 72 hours. The act was designed to enhance CISA’s ability to track, analyze, and respond to cyberattacks.

In addition, the Better Cybercrime Metrics Act was also recently passed; this law is designed to “improve the way the federal government tracks, measures, and analyzes cybercrime.” The law seeks to create a classification system to categorize various cybercrimes, enabling the FBI and security community to obtain a more holistic picture of the cyber threat environment.

Also, the Securities and Exchange Commission is considering a new rule to standardize disclosure of cybersecurity incidents at public companies. Specifically, the SEC is considering mandatory public disclosure of material cyber security incidents, as well as requiring periodic disclosure of a company’s security policies.

In response to the increasing operational and financial impact of cyber risks – and the increasing regulatory focus – insurance companies, financial institutions, and credit rating agencies are giving increased focus and weight to cyber risk and preparedness. Even before the new regulations and reporting requirements, some financial institutions and credit rating agencies publicly warned that cyber risk would be a higher area of priority in their analysis going forward.

And while 82 percent of companies are concerned their company is vulnerable to a cyberattack; 49 percent of companies lack the expertise for adequate mitigation and incident response, according to The State of Incident Response 2021 report.

It is evident that companies need to instill greater cyber risk and cyber security expertise in their leadership and their boards of directors. Although the focus and objectives of a board may vary depending on industry, size, and other factors, there are consistent underlying components. Financial, audit, risk, operational and strategic concerns are all well represented by board committees and members. Unfortunately, cyber security expertise is consistently lacking.

Most commonly, cyber risk and cyber security matters are handled by the audit or risk subcommittee of the board. But this is only because cyber security has been shoehorned into an old-world frame, where “audit” and “risk” are treated generically. Cyber security is clearly a very complex and critical topic, so it seems odd that the audit and risk committee would be lacking specific cyber security expertise. In such a structure, the board of directors is dependent on getting their cyber security expertise from sources external to the board. Typically, this is accomplished through periodic communications and reporting from the Chief Information Security Officer (CISO) or CIO.

This is not an ideal position considering ransomware and cyber risks are prime operational and financial risks to the business. Cyberattacks can pose a significant risk to business operations.

Cyber attacks increased 31% from 2020 to 2021, according to Accenture's State of Cybersecurity Resilience 2021 report. The number of attacks per company increased from about 200 to more than 270 per year. And the cost of cybercrime is predicted to hit $10.5 trillion by 2025, according to the latest version of the Cisco/Cybersecurity Ventures 2022 Cybersecurity Almanac.

Cyberattacks have the potential to not only interrupt operations and cause reputational damage but also cause significant financial and investment losses whether from theft of money or information or via reputational harm. And the increased required reporting of cyber incidents will increase public, investor, and financial institution awareness of cyber impacts and losses.

Business leaders need to ask themselves some questions: Can the board of directors actually do what it's supposed to do, fulfill its fiduciary duty, with regard to cyber risks given the current state of affairs? Can the board’s risk committee or the audit committee properly account for and understand cyber risk?

Is the current state what you want for your business, for a client who you are insuring, for a company you are investing in or lending to?

Boards of directors need to understand how to account for, evaluate, plan for and mitigate cyber risk. Currently, most boards rely on the CISO – and from a corporate view, most CISOs are still working in a silo. While the role of the CISO is evolving and has become increasingly indispensable to the business, most boards have not evolved in terms of cyber security. So, as robust enterprise cyber security capabilities become a more critical component of the operational and financial health of a company, the C-suite and board are only becoming more reliant on that single CISOs point of view.

One solution is to inject more CISO-like or security experience into a board, particularly outside CISO experience or governmental security experience. Prior government experience is often viewed as the path towards this expertise, but it’s only one option.

With the addition of board members with increased security experience, the board of directors can better understand and help direct investment where cyber risks exist – and better partner with CIOs and CISOs in understanding risk and the company’s capability to respond and mitigate that risk.

The Security and Exchanges Commission (SEC) recently issued several proposed amendments that could have an impact in this area. Amend Item 407(j) of Regulation S-K would “require disclosure about if any member of the registrant’s board of directors has cyber security experience.” This would require disclosure on annual reports, annual meeting proxy statements, and information statements if any of their board members have previous cyber security experience and the details necessary to fully describe that expertise.

We’ve all heard the phrase “today every company is a technology company” – and as companies increasingly depend on technology and as risk evolves, boards of directors need to evolve as well. With added CISO and cyber security experience available to the board of directors, companies and their shareholders will be better served.