The conversation around cybersecurity being a board level concern has been going on for decades. But thanks to a new survey, we are now getting new insight into how corporate directors understand their responsibilities in managing risk and responding to cyber emergencies.
Ahead of the enforcement of the US Securities and Exchange Commission (SEC) new requirements that public companies release uniform reports on cybersecurity risk management, governance, incident reports and cybersecurity expertise within the board of director, the Wall Street Journal and the National Association of Corporate Directors surveyed 472 directors across all industries about their current cyber risk management postures and their respective levels of preparedness. The results paint a mixed picture that reveals a fairly high level of expertise but a more reactive than proactive approach to security.
Go deeper with GlobalData
Most thought their management was in good position to manage cyber risk, with 16% rating that capability as “excellent” and 43% grading it as “very good.” However, the Wall Street Journal say there is a significant difference in this area between public and private companies. Some 51% of private companies said management was “excellent” or “very good” in shepherding the organisation’s risk management strategy, compared to 71% of public firms.
While most (84%) corporate directors had at least a moderate understanding of their cyber crisis management responsibilities, there were gaps in two verticals – the highly targeted energy and utilities sector and professional services firms. Some 26% percent of professional services firms said they were “not very clear” “not at all clear” on the part the board should play in responding to a cyber emergency. In addition 21% of energy and utilities admitted the to the same issue.
A hazier perspective on cybersecurity
Although the largest companies have a good understanding of what corporate board responsibilities will be with respect to the new rules, the smaller the firm the hazier that perspective gets. While 50% of large public companies said they were “very clear” and 45% “somewhat clear” only 60% of smaller businesses have that same grasp.
Fewer than half of all companies have conducted cybersecurity “tabletop exercises” in the last 12 months. These exercises shed light on regulatory responsibilities and simulate potential incidents so they can work through potential mitigation strategies. This underscores the reactive nature to security of most companies, public and private.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalData
