The First Step in Engaging Your Board in the Cybersecurity Conversation

By Eric Noonan • October 5, 2015

The Wall Street Journal recently published a consolidated set of highlights from recent surveys and reports dealing with risk and compliance issues. The results will hardly be surprising to security professionals, but they are an abysmal reminder of just how much work still needs to be done before boardrooms are really engaged on the issue of cybersecurity. One report by AT&T found, “75% of companies don’t involve their full boards in cybersecurity oversight, saying it is an IT issue and not a core business concern.” That aligns with my experience with the exceptions being companies who suffer a significant breach, not so surprisingly post-breach companies see a substantial increase in board involvement.

How to Engage Your Board in the Conversation

Change has to come from both inside and out. Security leaders inside of companies have to continue advocating for board engagement and navigating corporate politics to effect change. This work is made harder due to the lack of agreed-upon metrics and success criteria in cybersecurity, leaving leaders wondering where to start the conversation with their boards.

First Step:  A Measurable Framework

My answer, start with a comprehensive security assessment against a framework you can explain like the Critical Security Controls and brief your board on the results. The results focus executive attention on the 20 most important things they should understand, support and invest in. Everything else is noise until you are implementing these 20 critical controls effectively, which is conveniently measured by metrics provided in the controls document. Security assessments are an effective way to get the board engagement for a sustained period of time.

Externally, real change will only come with comprehensive legislation designed to enforce investment in people, processes, and tools. I’m not a legislator so I don’t profess to know all of the elements that the policy should entail, but I do know without said legislation investment will continue to be disproportionately allocated toward tools without a long-term plan to sustain those investments with the people and processes necessary to drive success.

CyberSheath Blog

CyberSheath Opens Registration For CMMC CON 2022

RESTON, Va. — June 8, 2022 — Federal contractors have been searching for direction after seeing a flood of messaging about the future of Cybersecurity Maturity Model Certification (CMMC). The nation’s largest CMMC conference has returned to help contractors navigate their course through the evolving compliance landscape.   Hosted by…

5 Reasons to Partner with CyberSheath

The threat landscape is only becoming more complex. Offload the responsibility of navigating cybersecurity issues for your customers by taking advantage of CyberSheath’s new Partner Program.   As a pioneer and industry leader in the managed security service provider space, our new offering helps you achieve rapid results and deliver…

CMMC Compliance Training: How to Earn Your Black Belt

Contractors in the Defense Industrial Base (DIB) are looking for direction as Cybersecurity Maturity Model Certification (CMMC) 2.0 nears. Compliance with CMMC and Defense Federal Acquisition Regulation Supplement (DFARS) is your key to doing business with the Department of Defense (DoD) and we can help you navigate those requirements and…

Our Trusted Partners

Tenable Microsoft Siemplify KnowBe4 ConnectWise DUO