WEBVTT

1
00:00:02.635 --> 00:00:03.403
The what,

2
00:00:03.403 --> 00:00:06.539
when, and how of effective board
communication.

3
00:00:06.773 --> 00:00:09.042
Part two.

4
00:00:09.042 --> 00:00:10.543
The cyber risk landscape

5
00:00:10.543 --> 00:00:13.613
is evolving rapidly, driven
by emerging threats,

6
00:00:13.747 --> 00:00:17.250
technological advancements,
and heightened regulatory oversight.

7
00:00:17.851 --> 00:00:21.388
Today's cyber leaders need to be agile,
forward thinking,

8
00:00:21.388 --> 00:00:26.159
and adept at engaging with the board
to foster organizational resilience.

9
00:00:26.493 --> 00:00:30.263
Chief Information Security officers
should partner with the board of directors

10
00:00:30.263 --> 00:00:34.067
and board committees
to ensure robust governance of cyber risk.

11
00:00:35.702 --> 00:00:39.239
In part one of the series,
we explored how CISOs can tailor

12
00:00:39.239 --> 00:00:43.376
their engagement with boards to enhance
understanding and drive better outcomes.

13
00:00:44.010 --> 00:00:45.245
In this installment,

14
00:00:45.245 --> 00:00:49.082
we present a framework for determining
the appropriate cadence of board

15
00:00:49.082 --> 00:00:52.986
level cyber discussions, preparing
for their oversight focused questions,

16
00:00:53.253 --> 00:00:56.256
and communicating effectively
during the cyber crisis.

17
00:00:57.257 --> 00:01:01.161
Establishing a regular cadence
for board level cyber oversight.

18
00:01:03.363 --> 00:01:04.230
The frequency and

19
00:01:04.230 --> 00:01:08.935
format of cyber risk updates to the board
should be tailored to the organization's

20
00:01:08.935 --> 00:01:12.439
risk appetite
sector and regulatory environment.

21
00:01:12.972 --> 00:01:16.843
While there is no universal
standard, leading practices suggest

22
00:01:16.843 --> 00:01:21.181
that boards should receive substantive
cyber risk updates at least quarterly.

23
00:01:21.881 --> 00:01:25.151
These sessions should be structured around
comprehensive assessment,

24
00:01:25.652 --> 00:01:28.621
such as those based
on the National Institute of Standards

25
00:01:28.621 --> 00:01:32.692
and Technology Cybersecurity framework,
and include at least one

26
00:01:32.692 --> 00:01:36.262
annual deep dive into the organization's
cyber risk posture.

27
00:01:37.063 --> 00:01:39.933
These engagements
are not merely informational.

28
00:01:39.933 --> 00:01:42.902
They are essential
for enabling boards of directors

29
00:01:42.902 --> 00:01:45.905
to fulfill their oversight
responsibilities.

30
00:01:45.905 --> 00:01:49.976
Regular updates allow the board to monitor
the evolving threat landscape,

31
00:01:50.410 --> 00:01:54.581
assess the adequacy of risk mitigation
strategies, and ensure

32
00:01:54.581 --> 00:01:59.219
that cyber risk remains integrated
into broader enterprise risk management.

33
00:02:00.186 --> 00:02:01.354
Boards of directors may

34
00:02:01.354 --> 00:02:04.958
also seek clarity on the organization's
cyber risk appetite.

35
00:02:05.225 --> 00:02:09.329
The rationale for resource allocation
and the robustness of incident

36
00:02:09.329 --> 00:02:12.332
response and disclosure protocols.

37
00:02:12.365 --> 00:02:15.401
Preparation should go beyond
assembling technical data.

38
00:02:15.802 --> 00:02:19.539
CISOs should crafted narrative
that contextualizes cyber risk

39
00:02:19.639 --> 00:02:23.309
with the organization's
strategic objectives and risk tolerance.

40
00:02:23.910 --> 00:02:26.045
Understanding the board's composition.

41
00:02:26.045 --> 00:02:30.483
Varying levels of technical fluency
and prior engagement with cyber topics

42
00:02:30.483 --> 00:02:33.486
can help tailor communications
that are both accessible

43
00:02:33.520 --> 00:02:36.422
and actionable.

44
00:02:36.422 --> 00:02:37.790
Preparing for oversight.

45
00:02:37.790 --> 00:02:39.325
Questions.

46
00:02:39.325 --> 00:02:44.430
Effective board communication requires
CISOs to anticipate the types of questions

47
00:02:44.430 --> 00:02:47.700
board members are likely to ask
in their governance capacity.

48
00:02:48.535 --> 00:02:51.237
To lay the groundwork
for productive discussions.

49
00:02:51.237 --> 00:02:55.542
Consider leveraging the following
key questions designed to foster oversight

50
00:02:55.708 --> 00:02:58.978
and strategic alignment
between board members and management.

51
00:03:00.547 --> 00:03:03.683
Key questions
for the board's oversight a cyber risk.

52
00:03:05.218 --> 00:03:05.818
What is the

53
00:03:05.818 --> 00:03:09.355
organization's cyber risk appetite
and how is it governed?

54
00:03:10.423 --> 00:03:12.625
Which assets constitute crown

55
00:03:12.625 --> 00:03:15.628
jewels and how are they protected?

56
00:03:16.196 --> 00:03:19.132
What is the overarching cyber
risk strategy

57
00:03:19.132 --> 00:03:22.135
and how does it align with enterprise
objectives?

58
00:03:23.269 --> 00:03:25.772
What is the rationale
for current investments

59
00:03:25.772 --> 00:03:29.008
in cyber risk mitigation
and response capabilities?

60
00:03:30.710 --> 00:03:33.980
How robust are incident response
and disclosure plans

61
00:03:34.247 --> 00:03:37.250
and have they been tested?

62
00:03:38.251 --> 00:03:41.588
Is the organization
prepared to maintain operations

63
00:03:41.588 --> 00:03:45.124
and resilience in the event
of a significant cyber incident?

64
00:03:47.393 --> 00:03:49.762
How are vulnerabilities identified,

65
00:03:49.762 --> 00:03:52.765
prioritized and disclosed to the board?

66
00:03:53.800 --> 00:03:55.802
How are regulatory and critical

67
00:03:55.802 --> 00:03:58.771
infrastructure requirements being met

68
00:03:59.405 --> 00:04:02.175
or organizations by technology products?

69
00:04:02.175 --> 00:04:05.178
How is secure by design being ensured?

70
00:04:06.212 --> 00:04:08.948
What metrics and key performance
indicators

71
00:04:08.948 --> 00:04:12.185
are used to monitor
cyber risk and program effectiveness?

72
00:04:13.720 --> 00:04:18.091
How is third party in supply chain cyber
risk being governed and monitored?

73
00:04:19.592 --> 00:04:19.959
These

74
00:04:19.959 --> 00:04:23.796
questions are intended to assist the board
in understanding its oversight

75
00:04:23.796 --> 00:04:26.899
responsibilities
and to spark meaningful dialog.

76
00:04:30.036 --> 00:04:30.570
Incident

77
00:04:30.570 --> 00:04:33.573
escalation and disclosure governance

78
00:04:33.773 --> 00:04:36.776
A well-defined incident escalation
and disclosure

79
00:04:36.776 --> 00:04:40.280
process is a cornerstone
of effective board oversight.

80
00:04:40.680 --> 00:04:45.451
This process should clearly delineate
thresholds for escalation

81
00:04:45.451 --> 00:04:50.223
to the board and relevant committees,
outline roles and responsibilities

82
00:04:50.223 --> 00:04:53.226
for the board and management
during a cyber incident.

83
00:04:54.060 --> 00:04:59.098
Ensure timely, transparent communication
that meets regulatory obligations.

84
00:04:59.132 --> 00:05:02.435
For example, SEC disclosure requirements

85
00:05:03.603 --> 00:05:08.308
disclosure governance should be documented
and regularly reviewed, enabling

86
00:05:08.308 --> 00:05:12.912
the board to exercise effective oversight
throughout the incident response process.

87
00:05:13.579 --> 00:05:18.351
Ongoing updates between the eradication
and recovery phases are critical

88
00:05:18.384 --> 00:05:21.788
to ensure the board remains informed
and can to fulfill

89
00:05:21.788 --> 00:05:24.791
its fiduciary duties.

90
00:05:25.425 --> 00:05:27.160
Conclusion.

91
00:05:27.160 --> 00:05:30.730
The dynamic nature of cyber risk demands
that CISOs

92
00:05:30.730 --> 00:05:34.434
adopt a proactive, strategic approach
to board engagement

93
00:05:35.101 --> 00:05:38.638
by aligning technical insights
with the Board of Directors governance

94
00:05:38.638 --> 00:05:43.643
mandate and establishing a regular cadence
of clear, business focused updates.

95
00:05:44.010 --> 00:05:46.813
CISOs can empower them to exercise
effective

96
00:05:46.813 --> 00:05:49.949
oversight
and drive organizational resilience.

97
00:05:52.752 --> 00:05:55.988
And need help facilitating effective board
engagement.

98
00:05:56.622 --> 00:06:00.126
Deloitte can help
CISOs and boards of directors translate

99
00:06:00.126 --> 00:06:03.596
complex cyber risks into clear,
actionable insights.

100
00:06:04.130 --> 00:06:08.401
Our team provides guidance on board
presentations, tailored communication

101
00:06:08.401 --> 00:06:13.106
strategies, and board education to support
effective cyber risk governance.

102
00:06:13.439 --> 00:06:16.442
Connect with us to learn more.

103
00:06:17.543 --> 00:06:20.713
This recording is produced by Deloitte
and Touche LLP.

104
00:06:21.214 --> 00:06:24.250
It provides general information
only and is not intended

105
00:06:24.250 --> 00:06:27.253
to constitute advice
or services of any kind.

106
00:06:27.720 --> 00:06:31.791
Before making any decision or taking
any action that may affect your business.

107
00:06:32.191 --> 00:06:35.128
You should consult a qualified
professional advisor.