Abstract

This IDC Tech Buyer Presentation reviews the smart questions that boards should be asking about cybersecurity, provides an example of appropriate but impactful governance, and demonstrates proven ways to present difficult messages to point board resources at needed areas for engagement and investment.

The World Economic Forum identifies cyber-risk as a "clear and present danger" and identifies cybersecurity as one of the top areas of focus for board-level oversight globally. In an environment where it is the CIO or the CISO being terminated in the fallout from an incident, IT leaders and CISOs are challenged to ensure that they not only support the C-suite structure but also bring critical risks and issues for the appropriate-level oversight including the board. One path to success is to recalibrate how presentations to the board are approached, taking a new focus on helping directors get to the right insight based on the smart questions they should be asking.

Boards will not interfere with operational or management decisions. The board has three critical roles: to provide oversight that enables business success, to consider and guide risk policy and tolerance preventing loss, and to enable the culture and strategic direction that delivers value.

"By framing board discussions around those responsibilities, IT leaders can shift the conversation from rote reporting on general cybersecurity benchmarks to impactful discussions where the board will have the insight to look for intervention and commitment," says Alizabeth Calder, adjunct research advisor with IDC's IT Executive Programs (IEP).

Coverage