Research reveals cyber risk is the best language for a C-suite audience

As a Chief Information Security Officer (CISO) or cybersecurity leader, one of the most important parts of your role is to manage the organization’s cybersecurity risk. Managing risk and minimizing the impact of cyber incidents strengthens trust between you and the executive team, which is essential for a successful cybersecurity program.

A recent survey of CISOs concluded that showing the value of cybersecurity through risk is the #1 way to communicate with the C-suite, Board of Directors, and other executive stakeholders. Why risk? Because addressing risk also addresses the bottom line – money. While top-level leaders may not grasp the intricacies of the threat landscape, they understand that exposure equals financial loss. A breach costs time and money to fix, and shakes customer trust, further endangering revenue streams.

A C-suite or Board that clearly understands cyber risk is more apt to provide support (e.g., budget, resources, strategy) to manage and reduce risk to acceptable levels. The question is how can cybersecurity leaders like you most effectively identify and communicate the organization’s risk exposure to the Board and other executives?

1. Accurately assess cyber risk

Conducting a formal risk assessment will identify the organization’s current risk exposure and establish a baseline of risk maturity with defined areas of focus to reduce risk. An effective cybersecurity risk assessment — with actionable and meaningful resultsfor the C-suite — should align with business strategy and objectives. Consider the following key activities:

• Identify critical assets (e.g., applications, environments, business units, resources) that have the most significant impact on the organization. This could be their criticality to generating revenue, the sensitivity of data handled/stored/created, implications to legal/contractual requirements, etc.
• Analyze vulnerabilities, and the threats that could exploit those vulnerabilities, for identified assets. Determine the most likely and most significant threat and vulnerability scenarios.
• Assess for risks known to be outside of the organization’s risk appetite. For example, if the organization is most concerned about ransomware, align risk scenarios to the threat of a bad actor holding critical data for ransom. This will grab the attention of your executives.
• Calculate and align risks to how the rest of the organization categorizes enterprise risks. For example, if the organization uses a Very Low to Very High qualitative scale, ensure that cyber risks are calculated on the same scale. 

2. Report risks to executives

If done correctly, and in alignment with business strategy, the risk assessment results should clearly resonate with Executives. Unless the Board is particularly tech-savvy, it is recommended to keep results at a high level and out of the technical weeds. Executive leaders are typically interested in the most significant risks to have an impact on the operational effectiveness of the business. Consider keeping the results to the “Top 5 Highest Risks” or cyber threats that make front page news, such as ransomware or website unavailability.

Ensure that in conjunction with the risks, risk reduction solutions are presented to Executives so decision makers can be better informed when advising on the direction of the business and the cybersecurity program. Risk reduction strategies may include purchasing and implementing security tools, contracting with a security vendor, building out security staff, establishing new processes, etc. Each of these have costs, either directly out of the budget or indirectly through dedicated man-hours. Ensure to clearly demonstrate how these cybersecurity investments will decrease risk and increase operational efficiencies, ultimately communicating the business value of cybersecurity. 

3. Monitor continuously; report regularly

The C-suite expects to see a return on security investments, and continuous monitoring and regular reporting is an effective way to show that ever-important metric of risk reduction. Consider periodically repeating the risk assessment. Mitigation activities that have been implemented (e.g., tools, controls, policies) should bring the risk down to an acceptable level. Ensure that executive leadership can see a decrease in risk, improvement of cybersecurity maturity, and a decrease in the likelihood of concerning risks.

In conclusion, communicating risk to the C-suite is the most effective way to obtain support and gain traction to reduce and manage cyber risk. A comprehensive risk assessment, aligned to business objectives, will derive metrics that can measure and communicate results in an easily-consumable format for executives. With the C-Suite on board, cybersecurity leaders can achieve cybersecurity goals, initiatives, and mature the security program.