Well, just like business has “gone global,” so have adversaries. These adversaries want to compromise your business not as a “hacktivist” (i.e., bringing awareness to something), but rather, they are in it for the money. The threat environment is always changing, and companies are being hit every day due to increasingly sophisticated tools and attack methods. Board members need to quickly understand the impact some of these threats might have on the organization they are serving. The first thing they will want to know is “how at risk is our business?” and the answer to that will depend largely on the maturity of the organization’s risk management process. They will need to know how well their organization understands and handles its risk.
Secondly, the Board will need to understand if the right controls are in place to reduce the company’s risk and lessen, or avoid, the impact posed by cyber threats. For example, ransomware is a significant cyber threat to many organizations. The Board should have a clear understanding of the risk ransomware poses to the organization and how prepared the organization is to handle an outbreak, should it be hit with ransomware.
One of the best ways to gauge a company’s readiness is reviewing the last enterprise cybersecurity Risk Assessment. If that hasn’t been performed in a while (or ever), it is highly likely that neither the Board nor company executives will have an accurate assessment of the risks posed by current threats to the organization. While risk assessments are a necessary part of any cybersecurity risk management program, a SOC for Cybersecurity analysis may be the “Good Housekeeping” seal of approval for many businesses seeking validation of their cybersecurity efforts. This report can provide greater confidence to Board members, shareholders and the business executives who want confirmation that the time and money resources that they are committing to cybersecurity are properly addressing cybersecurity risks.
