Cybersecurity on the management agenda
In recent years, according to latest international research, cybersecurity has gained a more important position on the management agenda. This year, it has also gained momentum due to the corona pandemic, as digitalization has taken a giant leap in the operations of most companies. According to research done this autumn, the significance of risks related to cybersecurity rose to the top in management assessments leaving behind, for example, financial and business-risks. However, the significant position that cybersecurity has in the agenda has proved to be a temporary achievement. Driven by new legislation or a major hack, the management team will commission an assessment of the current state of cybersecurity and launch measures to “get things right”. According to domestic observations, it often happens that after a momentary activity, the matter gradually disappears from the agenda and does not reappear unless something new and significant happens. The management team must ensure that the state and the areas of development of cybersecurity are regularly assessed and the development of the operating environment and performance is constantly monitored.
Management teams should receive regular information on cyber risks and the company’s ability to respond to them. According to a recent American study, the top three priorities of company management teams for cyber reviews are:
- Understandable, non-technical language use.
- Quantitative analysis of cyber risks and their impacts.
- Measurable development of a firm’s ability to combat cyber risks.
The performance of cyber and risk management directors has improved in recent years as three out of five members of the management team feel that they understand almost everything presented in the cyber review. Simultaneously, however, reviews and reports are said to be too technical. Creating a link between cyber issues and quantitative values is difficult. From an economic point of view, possible threats and their effects cannot be assessed, and no proper metrics have been developed to monitor performance developments. These areas need to be improved so that management teams can guide cybersecurity work within their own roles. The goal should be to create good “cyber risk literacy” for management teams so that they can make the right decisions and guide the company’s actions for improvement by anticipating risks.
The role and responsibilities of management teams
The role and responsibilities of management teams do not end with preparedness and by minimizing cyber risks. The true operational capability of a management team is tested when a serious cyber risk materializes. Smaller risks materialize on a daily basis in large organizations and are handled by cybersecurity managers and experts. The Management Team is informed of the materialization and impact of minor cyber risks and of the corrective measures taken through routine reports, and there is no need for the Management Team to intervene in the details of such events. It is therefore important to create a clear division of labor for managing different levels of cyber risks and to give operational cyber professionals peace of mind at work. Management is responsible for practicing crisis management and initiating measures quickly.
The realization of a cyber risk can trigger the security breach notification obligation defined in various regulations and legislation, in which case the issue quickly becomes a management level issue. The notification required by the regulation itself is simple to make, but ultimately it is the responsibility of the company’s top management. Failure to notify is a serious breach of current data protection legislation and cybersecurity directives. An important task of the management team is therefore to ensure that the notification process works sufficiently.
Even in a serious case, it is a good idea to leave the operational defence against cyber violations to experts. The involvement of authorities is again the task and decision of the management team.
