New framework to help boards avert losing battle against cyber risk

Boards are losing the battle against cybercriminals, warns a new report from The CityUK and Marsh, which puts forward a new framework to help board members advance cyber risk management. Launching the report and framework, John McFarlane, chairman of The CityUK, which represents UK-based financial and related professional services, said cybercrime is a clear and present danger to society and our way of life. Cybercriminals have “declared war”, which requires a “wartime response” from companies and their boards, he added. Mr McFarlane said the cyber threat is continually evolving. “It’s the black market on steroids,” he warned. The CityUK and Marsh’s Governing Cyber Risk: A Guide for Company Boards report is based on benchmarking interviews with 30 City of London firms. It finds that many companies are yet to meet the standards it puts forward and need to do more to address cyber risks. The report and framework are intended to help boards advance cyber risk governance, providing practical guidance on what boards can do to ensure security for their customers, people and companies. Mark Weil, CEO of Marsh UK & Ireland, said companies are making good progress on cyber risk management, but in some cases boards need to better challenge their companies’ cyber risk management practices. Company boards need to “grab” this risk and take action, said Mr Weil. Companies need to be in a “no-regrets” position, whereby they are prepared and able to respond in the pretty likely event they are breached. All of the firms spoken to for the report are doing a lot of work on cyber risk, Mr Weil noted. They have discussed the issue at board level, carried out tests, prepared for breaches, sought validation of cyber strategy and exchanged threat information with peers, for example. But there remains discrepancy over whether company boards are watching this risk or driving their organisation’s response and readiness, he noted. “The risk is real,”Mr Weil said, even before the advent of the EU General Data Protection Regulation, which comes into force next month and will impose strict breach notification requirements and introduce large fines. He added that boards have corporate governance and fiduciary duties to fulfil, noting that directors and officers claims are on the increase. Marcus Scott, chief operating officer, TheCityUK, said cybersecurity is now a major risk demanding board-level oversight as companies find themselves “under siege from cyberattacks”. “In fact, for many of our members it may well be the biggest single risk. As well as mitigating against external attacks, boards must be aware of supply chain threats which could penetrate a business through internal channels. These criminals are smart and persistent. The best form of defence is a collective, industry-wide approach. It’s essential for all boards to have robust governance systems in place to manage these risks,” he added. The report identifies six elements against which boards should benchmark their cyber risk governance – or indeed broadly any operational risk, Mr Weil explained. Those elements are: Strategy: how well does the board understand the company’s priorities and strategic approach to cyber risk and to what extent is cyber risk being factored into broader board-level decision making? Board ownership: to what extent does the board drive strategy and how well is it integrated into board-level risk management processes? Financial resilience: are cyber risks quantified and built into a stress-tested crisis recovery plan? Executive accountability: how are executive responsibilities for cyber risk management structured and how are individuals held to account? Assurance: where does the board get validation that cyber risk has been properly assessed and that the management response is robust? Reporting: how is the company’s cyber risk position and progress reported to the board? Once companies’ boards are benchmarking against those measures, it is possible to determine a company’s cyber risk management maturity, said Mr Weil. Vicky Ford MP, chair of the UK’s All-Party Parliamentary Group on Cyber Security, welcomed the guide. One in ten people in the UK has been a victim of a cyberattack, while UK citizens are 20 times more likely to be the victim of an online crime than offline, she noted. Seven in ten organisations have suffered a cyberattack and a large-scale attack is only a matter of time, Ms Ford continued. “This costs billions,” she said.

New framework to help boards avert losing battle against cyber risk

Want to read this article?

Read Next

Munich Re reorganises P&C underwriting in Asia Pacific, Middle East & Africa

Claims likely to increase as vessels remain stranded in Baltimore

Climate change to cause ‘massive economic damage’

Two-paced upstream energy market falls in favour of buyers

Energy insurer Paratus launches brokerage division

Munich Re reorganises P&C underwriting in Asia Pacific, Middle East & Africa

Claims likely to increase as vessels remain stranded in Baltimore

Climate change to cause ‘massive economic damage’

Two-paced upstream energy market falls in favour of buyers

Energy insurer Paratus launches brokerage division

Want to read this article?

Read Next

Munich Re reorganises P&C underwriting in Asia Pacific, Middle East & Africa

Claims likely to increase as vessels remain stranded in Baltimore

Climate change to cause ‘massive economic damage’

Two-paced upstream energy market falls in favour of buyers

Energy insurer Paratus launches brokerage division

Related Articles