{"id":7611,"date":"2020-05-14T11:33:22","date_gmt":"2020-05-14T15:33:22","guid":{"rendered":"http:\/\/www.healthguardsecurity.com\/?p=7611"},"modified":"2024-02-14T09:36:48","modified_gmt":"2024-02-14T14:36:48","slug":"cyber-in-the-boardroom","status":"publish","type":"post","link":"https:\/\/www.healthguardsecurity.com\/cyber-in-the-boardroom\/","title":{"rendered":"Cyber In The Boardroom: A Reporting Framework"},"content":{"rendered":"

Cyber Security Getting The Board’s Attention<\/span><\/h1>\n

It wasn’t very long ago that cybersecurity was primarily seen as just an IT issue and rarely received the attention of senior executives and boards. Many healthcare executives have either lived through an incident or seen the countless news headlines about organizations feeling the painful sting of lapses in cybersecurity. The cascading impacts of these lapses that include <\/span>operational<\/span><\/a>, <\/span>legal,<\/span><\/a> <\/span>safety<\/span><\/a>, and <\/span>financial<\/span><\/a> consequences have put cyber on the radar of many CEOs and boards.<\/span><\/p>\n

A 2018 <\/span>survey<\/span><\/a> of CIOs conducted by HarveyNash\/KPMG, found that board interest in cyber had risen by 23%, with only 22% indicating they felt their organization were well prepared for a cyber attack.<\/span><\/p>\n

Beyond the internal drivers for better board oversight of cyber risk, there is <\/span>growing regulatory pressure<\/span><\/a> pushing corporate boards to increase their cybersecurity expertise. Regulators such as SEC chairman Robert Jackson’s are recommending that boards ensure “internal controls, policies, and procedures that make sure that information on the ground in the company, about any cyber issues, makes its way up to the c-suite and the boardroom…”<\/span><\/p>\n

Obstacles <\/span><\/h2>\n

The Language Barrier<\/span><\/h3>\n

While CEOs and boards are taking a more active interest in cybersecurity, there remain significant obstacles that prevent proper oversight of cybersecurity risk. One of the biggest challenges is the language barrier that exists due to the overly technical nature of cybersecurity. Historically CISOs have struggled to translate the technical metrics and jargon-filled language of cybersecurity into reports that help boards gain a real understanding of the organization’s risk and the financial impact of incremental increases in cybersecurity investments. <\/span><\/p>\n

A <\/span>2016 board member survey report from Osterman Research<\/span><\/a> found that just over half (54%) felt that information they received from IT and security leaders is too technical, and often includes:<\/span><\/p>\n

    \n
  1. A complete list of vulnerabilities within the organization<\/span><\/li>\n
  2. Details on data loss<\/span><\/li>\n
  3. Downtime caused by data breach incidents<\/span><\/li>\n<\/ol>\n

    The same survey found that 85% of board members felt IT and security executives need to improve their board reports. <\/span><\/p>\n

    A <\/span>2018 survey of CEOs and boards conducted by Deloitte<\/span><\/a> stated, “cyber risk reports often focus on technical details and technological risks. Yet CEOs and board members could benefit from\u2014and be more engaged by\u2014cyber risk reporting and assurance that focus more on business risks and impacts.”<\/span><\/p>\n

    In a recent Wall Street Journal article, enterprise risk management expert and E-Trade board member <\/span>James Lam<\/span><\/a> warned technology and security leaders about presenting “silly” metrics to their boards. Lam also said, “…too many chief information security officers and chief information officers go to board meetings lacking perspective about how cyber risk is but one factor to be weighed in overall corporate strategy…CISOs and business executives should go beyond seeing cyber risks in technical terms and weigh the risk of, say, a data breach against the opportunity in a given digital endeavor for adding customers or increasing revenue.” <\/span><\/p>\n

    The Osterman Research study concluded that “As cybersecurity takes a new priority in the C-suite, it has led to more attention from the board of directors. IT and security executives are expected to report cyber risk metrics to the board that enables them to make informed decisions.” The report cited three things that boards want from IT and, security executives:<\/span><\/p>\n

      \n
    1. Reports with understandable language that do not require board members to be cyber experts<\/span><\/li>\n
    2. Quantitative information about cyber risks<\/span><\/li>\n
    3. The progress that has been to address the company’s cybersecurity risk<\/span><\/li>\n<\/ol>\n

      Lack of Cyber Performance Reporting Standards<\/span><\/h3>\n

      Unlike other well-established business domains with generally accepted reporting practices and methods, cybersecurity lacks an authoritative source that establishes standards and policies for measuring and reporting performance. As a result, IT and security leaders are often left to their own devices to determine the “right metrics” to include in their reports, ultimately guessing about the amount and type of information that warrants board attention. <\/span><\/p>\n

      Over the years, we have had countless conversations with CIOs and CISOs trying to solve this very problem. <\/span><\/p>\n

      RiSO: A Cyber Governance and Board Reporting Framework<\/span><\/h2>\n

      While there no shortage of cybersecurity frameworks and guidance for boards, we did not find one that did an adequate job of addressing the needs of boards by providing organizations a comprehensive and coherent view of their cyber risk landscape. This gap in the market is what we set out to address when we created the RiSO framework. <\/span><\/p>\n

      What is RiSO?<\/span><\/h3>\n

      RiSO is a governance and board reporting framework for cybersecurity.<\/span><\/p>\n

      RiSO Principles and Goals <\/span><\/h4>\n

      When creating the RiSO framework, we had a few core principles and goals in mind:<\/span><\/p>\n