How to build an organizational culture that is 'cybersecurity ready'

Cyber risk is one of the main challenges that organizations face today. The World Economic Forum's Global Risks Report 2022 highlights how cyber threats have intensified through digital transformation and growing digital dependency.

Cybersecurity failure, however, is still perceived to be a critical short-term risk, according to the report, and high-value companies are often breached, leading to significant negative impact on their performance.

Simple ransomware attacks have disrupted global companies for multiple weeks, leading to hundreds of terabytes of sensitive data being publicly published and even stock prices dropping temporarily by as much as 10%.

Companies are increasingly left vulnerable due to a lack of ‘cybersecurity readiness’ and are therefore prone to ongoing phishing attacks, that expose weaknesses in the systems such as stolen passwords or unpatched servers.

A recent study by Acronis showed that 80% of companies had suffered a cybersecurity breach over the past year, up from 68% from the previous year.

Meanwhile, 9% of the companies experienced at least one cyber-attack per hour, illustrating the current high levels of risk.

This indicates that organizations are increasingly vulnerable to cyber attacks on their businesses, yet most lack readiness in response, which is not at par with the growing sophistication of the attackers.

Most executives and board members are aware of key global cyber threats and recognize cybersecurity risk as an enterprise-wide risk, but not everyone understands the impact of these cyber risks and their economic drivers.

It is therefore imperative for organizations to implement capabilities to strengthen cyber resilience and ensure board members play an active role in leading this shift.

A new proposal from the US Security and Exchange Commission on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure highlights the need for board members to prioritize cyber risks in their planning.

Within this context, the World Economic Forum, in co-operation with the National Association of Corporate Directors and the Internet Security Association, published the Principles for Board Governance of Cyber Risk report in 2021.

This report describes the six principles that can help boards of directors with cyber risk governance which are: cybersecurity as a strategic business enabler; understand the economic drivers and impact of cyber risk; align cyber-risk management with business needs; ensure organizational design supports cybersecurity; incorporate cybersecurity expertise into board governance; and encourage systemic resilience and collaboration.

The fourth principle, “ensure organizational design supports cybersecurity” highlights the need to view cybersecurity from a strategic lens and ensure that internal governance mechanisms are established to address risks.

In order to implement this principle, key questions to consider are:

With this information, the board can fairly assess and evaluate the financial and economic impact of cyber risk relative to other enterprise-wide risks and determine the organization’s risk appetite, as well as establish accountability and risk ownership.

Once accountability and risk ownership has been defined and agreed upon across the organization, it is vital to develop a cybersecurity governance structure that is aligned to an organization’s business strategy.

Cybersecurity targets and objectives should be defined in alignment with the overarching strategy and the cybersecurity team should be consistently engaged with business representatives, executive leadership, and the board on both a strategic and tactical level.

The involvement of senior management and the board of directors is critical in many ways, as their role is to actively embed cybersecurity risk management in the organization top-down and demand cyber risk indicators be presented in financial and economic terms, so that they can be effectively compared to other risks and priorities in the company, while providing oversight on how cyber risk is monitored.

A cybersecurity strategy must be defined with a high-level plan for how your organization will secure its assets and critical business services in the short term and long term. As technology and cyber threats are unpredictable and constantly evolving, it is essential to account for updates to the strategy in the long term.

To develop a cybersecurity strategy that is aligned with organizational goals, clear lines of communication between the executive team and the cybersecurity organization should be established. Key points being:

While the security team is often at the forefront of cybersecurity incident response, coordination with other teams, as well as broader organization-wide awareness, will be critical in strengthening response capabilities. Multiple initiatives to collaborate with other departments should be implemented:

As our world becomes increasingly digitized, a push from the board for cross-functional collaboration across the organization will allow the security team to be better aligned with business needs.

It is key for organizations to have governance processes and structures that encourage communication and support the implementation of cybersecurity readiness initiatives.

Cybersecurity must be a core strategic priority, and ownership and accountability for cybersecurity risk management activities must be adopted both within and outside the CISO organization.

It takes some effort to change existing structures and introduce new processes to elevate the conversation of cybersecurity risk considerations. This change has to be supported by the board and executive management in order to be successful:

The ultimate protection against cyber threats is that of instiling an organizational culture that is ‘cybersecurity ready’ and that is knowledgeable and prepared to mitigate the risks at all levels of its strategy and operations.