“Esoteric risk mapping, simplistic quantification techniques, indefensible expertise gaps, techno-babble and executive double-speak are no match for digital era danger.” Sound familiar? UHC is being called to task by Sen. Ron Wyden for their major major breach and lack of board focus on cybersecurity. The culture of cybersecurity starts at the top by hiring real expertise on cybersecurity at level of those that are ultimately responsible, the Board. If nothing else, read Sen Wyden’s letter to the FTC and SEC chairs to your Board. https://lnkd.in/eq-9ZSmM #cybersecurity #ciso #cybergovernance
Gosia Markowska
7mo
If you will look at annual reports of many listed companies, cyber risk won't be mentioned as one of the Principal Risks or will be 'buried' in one of pillars or risks drivers.
Transformative Servant Leader in Risk Management and Cybersecurity | Expert in Building High-Performance Teams and Driving Collaborative Solutions to Tackle Emerging Threats and Navigate Complex Regulatory Landscapes.
7moJoel - your summary is 100% spot on. I fear the executive leadership challenge (tone from the top) you mention will not change until laws are passed requiring CEOs to certify the efficacy of their company's cyber risk management program similar to the USA law SOX with respect to financial statements and associated controls/safeguards. We don't need more "notification" laws or requirements, we need simple accountability and that too should not only include the CEO but Board Directors for their duty of care in supplying appropriate governance necessary commensurate with the type of company, but especially those servicing critical infrastructure sectors. The CISO needs to be held accountable for supplying REAL risk/exposure data (aka KRIs, not KPIs, OKRs, etc.). Real Dashboards by business, by region measured against a specific risk appetite (direct/indirect financial loss and/or impact ot life safety as applicable). Only then, we will see a material change in the culture of many companies who will begin to understand what "duty of care" means and that they are reminded WHY the company is in business, not just the HOW or the WHAT.