New warning that boards are unprepared for cyber attack

Key decision makers do not have confidence in their boards’ ability to manage cyber security threats, according to analysis from Control Risks. The global Cyber Security Landscape survey of IT and business decision makers found almost half of respondents reporting their organisation’s board-level executives do not take cyber security as seriously as they should. This is despite 77% of respondents citing the c-suite, rather than the historic owner, the IT department, as being most accountable for cyber security management and decision making in their organisation. The survey also found that more than 31% also reported they are very or extremely concerned their organisation will suffer a cyber attack in the next year and a third (34%) said their organisation does not have a cyber crisis management plan in place in the event of a breach. This lack of preparedness is especially striking in the light of the WannaCry ransomware attack, which affected 150 countries in less than 12 hours. The survey’s key findings were: Companies are struggling to adopt a risk-based approach: Although companies are now less concerned with merely complying with standards and are focused on actually reducing the risk of a cyber attack, almost half (45%) agreed that assessing and managing these risks is their biggest challenge. Third-party breaches are a growing concern: More than a third (35%) of respondents said a third-party cyber breach had affected their organisation and despite nine in ten respondents (93%) taking steps to evaluate their third parties’ cyber security measures, 53% said this was confined to contractual measures. Cyber attacks have major long-term effects: four in ten respondents said a cyber attack has resulted in the misuse of sensitive or confidential information (43%) and a loss of customer information (41%). George Nicholls, senior partner at Control Risks based in Johannesburg, said: “The misalignment between treating cyber security as a technological issue or a business risk is not new. Yet, the survey shows that this misalignment remains a considerable and ongoing concern for many organisations. “Our advice is to always start with the threat,” he added. “The way in which cyber threats are assessed and communicated throughout the business is key. This assessment should include the specific cyber threats to the organisation, how they could impact the business and what controls might mitigate them. After assessing the risks and understanding them, the organisation can then deal with these within its overall risk management strategy.” Organisations should ensure cyber security becomes a regular item on the board’s agenda that includes reviewing the external cyber threat landscape in conjunction with IT. Organisations also benefit from regular crisis management exercises that involve all relevant parties including the c-suite, IT, legal, communications and any other members of the crisis management team. These exercises ensure that all parties understand their roles and responsibilities, and the potential implications of a cyber attack.

New warning that boards are unprepared for cyber attack

Want to read this article?

Read Next

Swedish risk managers told to focus on flexibility rather than resilience

European Parliament votes for ‘hard-fought compromise’ on CSDDD

Rates fall in most regions during Q1 but rise in Europe and US: Marsh

Major cyberattack would hike rates but insurers would ‘brush off’ losses: Lockton Re

Chubb says Q1 saw ‘best rates’ as it books $2bn profit

Swedish risk managers told to focus on flexibility rather than resilience

European Parliament votes for ‘hard-fought compromise’ on CSDDD

Rates fall in most regions during Q1 but rise in Europe and US: Marsh

Major cyberattack would hike rates but insurers would ‘brush off’ losses: Lockton Re

Chubb says Q1 saw ‘best rates’ as it books $2bn profit

Want to read this article?

Read Next

Swedish risk managers told to focus on flexibility rather than resilience

European Parliament votes for ‘hard-fought compromise’ on CSDDD

Rates fall in most regions during Q1 but rise in Europe and US: Marsh

Major cyberattack would hike rates but insurers would ‘brush off’ losses: Lockton Re

Chubb says Q1 saw ‘best rates’ as it books $2bn profit

Related Articles