Principles For Board Governance Of Cyber Risk

2.2 Understand the economic driversand impact of cyber riskCyber riskremains amongthe top risksfacing businessorganizationstoday. However,only 17% oforganizations saythey are realizingthe benefitsfrom betterquantificationof cyber risk.Enterprise decision-making requires analysisof the economics of cyber riskMany business initiatives that drive profitability canalso increase cyber risk. In order for organizationsto make effective business decisions, riskdeterminations should focus on the financial impactto the organization, including trade-offs betweendigital transformation and cyber risk. By usingscenario planning, leaders in the organization canconsider potential gains and losses relative toother business priorities and obligations. Leadersshould also measure cyber risk (empirically andeconomically) against strategic objectives, regulatoryand statutory requirements, business outcomes andcost of acceptance, mitigation or transfer.Review and approve the organization’s cyberrisk appetite, or tolerance,9 in the context of thecompany’s risk profile and strategic goals byensuring management has:–Defined cyber-risk appetite levels in financialterms to inform decision-making anddeveloped key metrics to measure overallcyber-risk management performanceImplemented a programme that seeks toidentify cyber-risk scenarios that align withthe organization’s risk profile and establish arisk appetite–Provided the board with detailed rationalesfor the organization’s determination ofmateriality of risk, including cyber risk,based on an indication of the risk’sreputational, customer, financial and otherrelevant impacts as part of its regular riskmanagement monitoring framework–Instruct management to establish a consistentframework, using industry-accepted riskquantification models, for calculating thepotential economic impact and likelihood ofcybersecurity scenarios–Require continuous examination of comparativemeasurements and metrics10 for cyber risk.Industry-accepted frameworks and reportingcan guide data-driven decisions, aligning riskappetite with organizational goals and strategy–Base cyber-risk management decisions on thepotential impact and likelihood of risk eventsand functional loss or exposureKey considerations for the board:––Economic decision-making in the context of cyber riskChoosing to enter a new market may have substantial business advantages. However, the cyberrisks – such as additional network connections, theft of IP and new regulatory exposure – couldbe just as, or even more, substantial. This is a strategic business decision for the board.The board needs to consider not just the economic upside of the new market but the economicdownside of the cyber risk. Management should provide the board with an empirical and economicassessment of the probable extent of cyber risks versus the probable business advantages usingmodern risk-assessment techniques that enable such analysis. This analysis also helps determinethe appropriate risk-mitigation or risk-transfer mechanisms available to compensate for the risk.1137% of organizations strongly agree that quantifying risks leads to better management of cyber risksagainst the spend; chief executive officers are more likely to strongly agree.However, only 17% of organizations say they are realizing the benefits from better quantification of cyberPrinciples for Board Governance of Cyber Risk8

2.3 Align cyber-risk management with business needsimplications of their activities, including relevantcyber risks, risk ownership and alignment to theenterprise risk-management programme, whilenot neglecting to cover how decisions on cyberrisk are trackedBoards should understand and assess how toeffectively manage cyber risks in the pursuit ofbusiness objectivesBy focusing on how to treat cyber risks (throughavoidance, acceptance, mitigation or transfer),organizations can build a security profile that alignswith business needs and defined risk tolerances orrisk appetite. Effective governance of any enterpriserequires clear alignment between cyber-riskmanagement and business objectives across everyfacet of decision-making, including mergers andacquisitions, business transformation, innovation,digitalization, pricing, product development, marketexpansion etc.Key considerations for the board:– Critically review the organization’s businessstrategy and drivers (e.g. digital growth) in thecontext of their cyber-risk implications––Require management to report to the boardwith well-developed, written and tested plans(or roles in the overall plan) to counter adversecyber events–Require management to integrate cyber-riskanalysis into significant business decisions(e.g. launching a new product or publishing anapp), along with effective assurances of theinformation’s quality and comprehensiveness–Require management to provide the boardwith roadmaps on how the company makesdeterminations of risk materiality that informregulatory obligations13Require management (i.e. the entire C-suite)to report to the board on the cybersecurityPrinciples for Board Governance of Cyber Risk9

2.4 Ensure organizational designsupports cybersecurityaccountability for cybersecurity strategy, policyand executionOrganizational structure should integrate andsupport security and strategic goalsOrganizations should design an internal governancestructure that addresses cybersecurity on anenterprise-wide basis. This includes definingclear ownership, authority and key performanceindicators (KPIs) among all internal stakeholdersfor critical risk management and reportingresponsibilities. It also demands the integrationof cybersecurity practices into how the businessoperates and makes decisions.Key considerations for the board:– Review the organizational structure to ensurethat the cybersecurity function is adequatelyrepresented across the business, internalgroups and leadership––Set expectations that cybersecurity andcyber-risk functions are to receive adequatestaffing and funding and monitor the efficacyof these determinations–Inspire a cybersecurity culture and encouragecollaboration between the cybersecurityfunction and all stakeholders relating to, andaccountable for, cyber risk at various levels(e.g. compliance, privacy etc.)–Ensure an accountable officer14 has authorityand responsibility to coordinate cyber-riskstrategy throughout the organization and thatthe organization has a comprehensive plan fordata governanceUnderstand the basis for, and challenge theassignment of, important roles and lines ofIn a survey of more than 400 global companies, conducted by PwC in Q4 2020, 44% of board memberrespondents stated that their organizations have made significant progress over the past three years inimproving employee experiences with the cyber function.Meanwhile, 46% of board member respondents reported their companies making significant progress over thesame period in more effective alignment between risk management and their organization’s cyber programme.Principles for Board Governance of Cyber Risk10

2.5 Incorporate cybersecurity expertiseinto board governanceBoard membersmust work closelywith managementto maintainan informedunderstandingof cyber risksto enable theorganizationto serve as aresponsible partyin the broaderenvironmentin which thebusiness operates.Boards need diverse sourcesof cybersecurity expertise–Partake in opportunities to increase boarddirectors’ base level of knowledge on cyber riskBoards must avail themselves of external industryand other guidance as well as the cybersecurityexpertise of fellow directors, third parties andinternal resources to effectively oversee theorganization’s cybersecurity within an appropriatestructure focused on oversight. In light of therapidly changing cyber landscape, board directorsthemselves must continually seek to expand theirown knowledge of this topic.–Seek out third-party advisers and assessors –who report to the board regularly – to ensureeffective oversight of management–Consider periodic audits, reviews ofcybersecurity strength and benchmarking byindependent third parties–Carry out regular sessions with the board toupdate the group on recent cyber incidents,trends, vulnerabilities and risk predictions. Useexternal third parties, where necessary, toensure accuracy and competenceKey considerations for the board:– Build relationships with internal stakeholderswho can provide expertise to guidestrategic cybersecurity decisions, up toand including ensuring cyber expertiseis represented on the boardBoard allies in cybersecurityDoes the board need a “cyber expert”?Directors, recognizing that cyber risk is anenterprise-wide concern, should look to a varietyof executives and managers in order to ascertainthe full impact of cyber risk on the organization.Each member of the management team has aresponsibility to understand the impact of cyberrisk within her or his remit and can thereforesupport the board’s effort to develop a holisticview. While the chief information security officer(CISO) may be some organizations’ foremostcyber-risk expert and main point of contact forthe board on cyber-risk issues, the CISO neednot work in isolation. Executives who can supportthe board’s understanding of cyber risk include:Considering how pervasive cyber risk has become,some companies may seek to recruit boarddirectors with cyber risk or cybersecurity expertise.While the question of how necessary this is ariseswith greater frequency as digital risk becomes morewidely recognized as a feature of modern business,there is no one answer that will fit every company.At the outset, companies should consider whetherthe board would be better served by increasingthe entire board’s understanding of cyber risk,rather than relying on a single member. Additionally,the board should consider the interface betweencyber-risk management structures already inplace with the board as well as the availability of“cyber experts” for recruitment and the specificattributes of expertise necessary in a candidate.15–Chief risk officer–General counsel/chief legal officer–Chief information officer–Chief technology officer–Chief trust officer–Chief privacy officerThis is a non-exhaustive list of allies the board cancall upon to examine the company’s cyber risk.Principles for Board Governance of Cyber Risk11

2.6 Encourage systemic resilience and collaborationa socially responsible party in the broaderenvironment in which the business operatesEffective cyber-risk strategy includes improvingthe cyber resilience of industries and sectorsThe highly interconnected nature of modernorganizations means we run the risk of failuresthat spread beyond one enterprise to affect entireindustries, sectors and economies. It is no longersufficient just to ensure the cybersecurity of yourown enterprise; rather, cyber resilience demandsthat organizations work in concert. Recognizingthat only collective action and partnership can meetthe systemic cyber-risk challenge effectively, seniorstrategic leaders must encourage collaborationacross their industry and with public and privatestakeholders to ensure that each entity supports theoverall resilience of the interconnected whole.Key considerations for the board:– Develop a 360-degree view of the organization’srisk and resiliency posture to operate as–Develop peer networks, including other boardmembers, to share best governance practicesacross institutional boundaries–Ensure management has plans for effectivecollaboration, especially with the public sector,on improving cyber resilience–Ensure that management takes into accountrisks stemming from the broader industryconnections (e.g. third parties, vendorsand partners)–Encourage management participationin industry groups and knowledge andinformation-sharing platformsThe systemic implications of cyber riskCyber risks can arise from a company’s network of partners, suppliers and vendors. Althoughnot common, supply-chain attacks can tear through increasingly interconnected companies,passing from vendor to partner, and wreaking havoc on industries and economies.In 2017, the NotPetya attack spread from a malware-infected system in Ukraine to paralyseglobal shipping and cause an estimated 10 billion in damages to a wide variety of industries,from pharmaceuticals to construction, from personal care to consumer foodstuffs.16In 2020, malware was uploaded to much of the US federal government, including the Department ofDefense, to 425 companies in the US Fortune 500, and to as-yet-untold other customers worldwide, bycompromising an update installed by SolarWinds, a US-based technology infrastructure vendor.17 Theextent of the damage likely to follow, or even the purpose of the attack, is still open to speculation.Principles for Board Governance of Cyber Risk12

ConclusionBoard directors should adopt theconsensus principles described in thisreport to form the basis of an effectivecyber-risk governance regime.The board needs to understand cyber risk, and itsrole in governing this threat, to perform its oversightfunction effectively. It continues to be important formembers of the board of directors and industryprofessionals to increase their knowledge of howto address cybersecurity within their organizations.This report offers an opportunity for directors toincrease their understanding of cyber risk andprovides guidance for interactions as boarddirectors more fully embrace their role with regardsto cyber risk.on an effort to quantify the efficacy of theseprinciples. What began as an offering of goodpractices here will soon expand into a researchagenda that will help board directors to determinewhere best to apply their limited time and whichaspects of the principles described here are likelyto be the most crucial to implement in the shortesttime frame. While all of the principles described inthis report form the basis of an effective cyber-riskgovernance regime, soon we will understand whatimpact adoption of each principle is likely to have.As part of this body of work, the World EconomicForum, NACD and ISA will continue their sharedefforts to enhance boards’ ability to incorporatecyber-risk planning into overall company strategy.Towards that end, our organizations have embarkedWe ask readers of this report to adopt the principlesdescribed, endeavour to understand the impact ofcyber risk on business strategy and work togetherto ensure that every organization is cyber resilient.Principles for Board Governance of Cyber Risk13

TaxonomyTermDefinitionAccountable officerA senior executive within the organization who is responsible andaccountable to the board for developing and implementing the organization’scyber-risk and resilience programme18Board and boardof directorsCorporate fiduciaries responsible for overseeing management strategy,as well as the identification and planned response to enterprise-wide risksaffecting a company and its value to stakeholders and shareholders19Cyber resilienceA dimension of cyber-risk management, representing the ability of systemsand organizations to develop and execute long-term strategies to withstandcyber events;20 an organization’s ability to sustainably maintain, build anddeliver intended business outcomes despite adverse cyber events21Cyber riskProbable loss event that materializes when a cyberthreat affects an asset ofvalue and results in a material impact on an organization. Cyber risk can bemeasured as the probable frequency and the probable impact of a loss event22Consideration should be given to the following aspects of this risk:–Physical – core technical infrastructure of hardware and software–Informational – content or data at rest or in transit–Cognitive – knowledge, values, beliefs, intentions and perceptions ofindividuals and groupsCybersecurityThe set of activities that protect networks, devices and data fromunauthorized access or criminal use and the practice of ensuringconfidentiality, integrity and availability of information and properdelivery of services 23Systemic cyber riskThe risk that a cyber event (attack[s] or other adverse event[s]) at anindividual component of a critical infrastructure ecosystem will causesignificant delay, denial, breakdown, disruption or loss, such that not onlyare services affected in the originating component but consequences alsocascade into related (logically and/or geographically) components of theecosystem, resulting in significant adverse effects to public health or safety,economic security or national security24Principles for Board Governance of Cyber Risk14

ContributorsLead authorsJeremy JurgensManaging Director, Head of Centre for Cybersecurity,World Economic ForumLarry ClintonPresident, Internet Security AllianceJoe NoceraDaniel DobrygowskiLeader of Cyber and Privacy Innovation Institute,PwC (Project Adviser)Head of Governance and Trust, Centre forCybersecurity, World Economic ForumSean JoyceGlobal and US Cybersecurity, Privacy andForensics Leader, PwC (Project Adviser)Friso Van der OordSenior Vice-President, Content,National Association of Corporate DirectorsAdvisory teamIndependent Board DirectorAdvisory PanelThese independent board directors, who volunteeredto share their experience at the board level, contributedknowledge and feedback to this effort in their individualexpert capacity.Keith Alexandersitting on the board of AmazonCaroline DorsaNisha Almoulasitting on the board of BiogenProject Fellow, World Economic Forum, New YorkLynn DugleClark Andrewssitting on the board of State StreetProject Fellow, World Economic Forum, New YorkLinda HudsonGeorges DeMourasitting on the board of Bank of AmericaHead of Industry Solutions, Centre for Cybersecurity,World Economic ForumLeslie Irelandsitting on the board of CitiChris HetnerSpecial Advisor for Cyber Risk, National Associationof Corporate DirectorsShelley LeibowitzPresident, SL Advisory, on the boardsof MassMutual and Morgan StanleyJosh HigginsSenior Director of Policy and Communications,Internet Security AllianceMichael G. VickersAkshay JoshiMaggie WilderotterHead of Operations and Partner Engagement,Centre for Cybersecurity, World Economic Forumsitting on the board of Hewlett Packard Enterprisesitting on the board of BAE SystemsPrinciples for Board Governance of Cyber Risk15

AcknowledgementsWorking groupCandid WüestVice-President of Cyber ProtectionResearch, AcronisTracie GrellaGlobal Head of Cyber, AIGAnthony ShapellaHead of Analytics, Cyber Insurance, AIGCatharina RichterGlobal Head of Cyber Center ofCompetence, AllianzShanil WilliamsGlobal Head of Financial Lines. AllianzMichael MeliChief Information Security Officer and ManagingDirector, Bank Julius BaerCraig FroelichChief Information Security Officer, Bank of AmericaKristen MarquardtSenior Vice-President, Cyber Strategy andCommunications Bank of AmericaJohn SlavittGeneral Counsel, Check Point SoftwareTechnologiesDarren ThomsonHead of Cybersecurity Strategy, CyberCubeJoram BorensteinGeneral Manager, Cybersecurity Solutions Group,MicrosoftPaul CalatayudChief Security Officer, Americas, Palo Alto NetworksRyan GillisVice-President, Cybersecurity Strategy and GlobalPolicy, Palo Alto NetworksJanus Friis BindslevChief Digital Risk Officer, PensionDanmarkSwamy KocherlakotaEx

1 Principles for board governance of cyber risk 2 Cyber-risk principles in-depth 2.1 Cybersecurity is a strategic business enabler 2.2 Understand the economic drivers and impact of cyber risk 2.3 Align cyber-risk management with business need