In an interview with the Washington Post this week, Director of the United States Cybersecurity and Infrastructure Security Agency (CISA), Jen Easterly, discussed a number of recent high-profile cybersecurity news items, including the Facebook/Instagram/WhatsApp outage, the SolarWinds hack, election security, and the Federal Government’s general role in addressing well-planned cyber-attacks from foreign actors.
After many of the large-scale cyber events hit the news over the past few years, frantic calls made from CEOs and Board of Director members to Chief Information Security Officers typically started with a question along the lines of “Could this happen to us?” In response, CISOs typically provided some security metrics and KPIs supporting a belief that the organization was well protected, albeit followed with a reminder that more money for more controls would always be helpful.
January 1st is almost upon us, and there are only a few days left to solidify your resolutions for 2020. In our quest to make the start of the New Year as easy as possible, we’re excited to present Part III of our 2020 Resolution Series, with this week’s version focused on the Board of Directors and the resolution of achieving defensible Duty of Care.
Welcome to Part II of Axio’s 2020 Resolution Series. We’re one week closer to some well-needed rest around the holidays and one week closer to the start of the 2020 sprint into a great year! As 2019 winds down, we hope that our Resolution Series can set priorities for the new year.
Welcome to Axio’s 2020 resolution series. In the spirit of the holidays and with an eye towards being more practical than offering a set of predictions that may or may not come true, we’re instead offering one New Year’s resolution suggestion per week for each of the next four weeks. As you’ll read over the next month, each resolution is geared towards a specific person or group of individuals, each of whom plays a critical role towards cybersecurity. We’ll start this week with the CFO, who we resolve in 2020 will achieve “Investability.”
Ask your typical private equity executive how he or she evaluates and manages the financial performance of their portfolio, and you’ll nearly certainly get a response along the lines of “We invest in companies that have solid assets, but not fulfilling their entire potential, we’ll deploy mature management and operational strategies, set financial performance targets that get benchmarked against peers, and ultimately, build a solid story that allows us to realize gains upon exit.”
“One of the areas where I think we’re having a lot of success is helping the tech individuals speak business. Before, they say, ‘…we’ve identified these five risks that are all red on my chart,’ which means nothing to a CFO or CEO. We’re putting a tool in their hands where they can quantify those risks… And now you’re speaking their love language: it’s financial terms.”
One of the biggest obstacles to achieving cybersecurity maturity is a language barrier: security leaders speak tech, risk managers speak insurance, the legal team speaks contracts, CFOs speak ROI, and the C-suite and Boards of Directors speak duty of care and financials. In practice that translates to business leaders not understanding how operations can be impacted by a cyber event, money being spent in the wrong places, and a lack of coordination of critical functions.
“To make crucial business decisions related to the veracity of ongoing digital business, operations will generate high demand for these software solutions”, report states.
In November we wrote that Moody’s announcing it intended to consider cybersecurity and cyber risk in financial ratings was the Trifecta of Board of Director centric cybersecurity developments, with the first being CEO and CISO firings in the wake of high profile events of recent years, and the second being the SEC’s updated guidance on how companies should understand and disclose cyber risk. Any doubt about the significance of that announcement no longer exists, as Moody’s has acted on its word and downgraded Equifax’s outlook from “Stable” to “Negative,” based primarily on concerns about Equifax’s cybersecurity.