EXECUTIVE SUMMARY:
Historically, communicating the value of cyber security to the board has always been a challenge. Cyber security staff and solutions are typically out-of-sight and out-of-mind, until something goes terribly pear-shaped.
Although there isn’t a single, uniform way to convey cyber security’s value to the board, there are a variety of highly effective strategies that can provide valuable guidance and that can neatly set leaders up for success.
Cyber security leaders are invited to leverage the strategies below in order to ensure that cyber security is seen as a critical business support mechanism that must be continually evolved and adapted to align with today’s digital realities.
5 ways to communicate cyber security value to the board
1. Build a coherent cyber risk narrative. It’s safe to say that most CISOs are aware of the need for effective communication, but many struggle to craft narratives that will build awareness and help obtain buy-in for new projects or initiatives.
As a CISO, start by addressing unacceptable outcomes. Describe how failure to address a certain problem will result in negatives for the business. Then, shift into how to build pathways that help everyone avoid the manifestation of those outcomes.
A narrative-development strategy recommended by CISO and author Andy Ellis is to consider ‘what is the least amount of information that stakeholders require in order to understand the issue, validate my solution and take action?’
A coherent cyber risk narrative should also remain continuous throughout the conversation. In the event that a stakeholder inquires off-handedly about a technical detail, the discussion should not derail.
2. Develop board-ready reporting. Create visually engaging reports that are easy to comprehend.
Line charts, bar graphs and pie charts, for example, can be employed to emphasize changes in frequency of threat events, the success of risk mitigation strategies, or the distribution of cyber security investments.
And charts illustrating the financial implications of a cyber security incident can convey the potential impact of an event more effectively than a verbal description alone.
Board-ready reports can assist with data retention, and help ensure that the board’s time, which is a limited resource in and of itself, is used effectively.
(That said, it’s also important to get the balance right and to avoid overwhelming the audience with too many visuals.)
3. Quantify risk in financial terms. Cyber attacks pose a direct threat to an organization’s financial health, a topic that C-level executives are deeply concerned with.
To effectively quantify cyber security risk in financial terms, adopt a quantitative risk assessment methodology. This involves assigning monetary value to potential risks based on elements such as asset value, threat frequency, and control effectiveness.
| In other words, C-levels often see the world in terms of dollar signs; profit and loss. Frame conversations around these concepts. |
Leverage metrics such as Annualized Loss Expectancy (ALE), which helps to provide a numerical representation of the financial impact associated with specific threats.
Further, utilize cost-benefit analyses in determining how to allocate resources in order to mitigate identified risks.
Expressing cyber security risks in financial terms enables more informed decision-making and improved resource allocation – ultimately strengthening the organization’s overall cyber resilience.
4. Emphasize business alignment. To demonstrate the value of cyber security, emphasize how cyber security activities align with broader business goals.
For a CISO, the connection between cyber security and business enablement is clear, but this isn’t always the case for executives or board members. A security threat is a business threat.
Show how the capabilities of the cyber security staff can enable C-levels and board members to better achieve their objectives, such as improved business resilience and business continuity in the event of an incident.
Show how security initiatives result in valuable business outcomes.
5. Showcase return on investment (ROI). To truly convey the value of cyber security to the board, CISOs must ensure that they can prove a return on investment for cyber security initiatives.
For example, CISOs may want to demonstrate how specific prevention and response systems result in reductions in incident response times over the course of a fiscal year.
In turn, this saves the organization money, as otherwise, threats could linger in systems for longer durations of time (APTs), resulting in more significant cyber security disruptions.
By presenting tangible ROIs, CISOs not only validate the significance of cyber security expenditures, but also provide a basis for strategic decision-making when it comes to future investments.
|
Related resources |