News Brief: Carnegie Mellon Report the First To Examine How Corporate Boards and Executives are Managing Cyber Risks

The Carnegie Mellon Governance of Enterprise Security: CyLab 2012 Report is the first survey to examine how corporate boards and executives are managing cyber risks across geographical regions and by various industry sectors.

Sponsored by RSA, The Security Division of EMC, this is the third report conducted by CyLab Adjunct Distinguished Fellow Jody Westby. The report examines responses to a survey of senior executives and corporate board members from the Forbes Global 2000 list. The report reveals that corporate boards and executives are taking risk management seriously but there is still a gap in understanding the link between information technology (IT) risks and enterprise risk management. This gap indicates that boards have a lack of understanding of how all business operations are supported by computer systems and digital data and how risks in these areas can undermine operations. Less than two-thirds of the respondents' organizations have full-time personnel in key roles for privacy and security (CISO/CSO, CPO, CRO) in a manner that is consistent with internationally accepted best practices and standards. The degree to which these roles are filled varies by industry and region.

Survey results in the report confirms the belief among security experts that, overall, the financial sector has better security and governance practices than other industry sectors. The financial sector shows the greatest degree of board attention to critical issues related to cyber risk management, while the energy/utilities and industrials sectors reveal a lack of board attention to critical issues such as vendor management, computer and information security and IT operations. The energy/utilities respondents also rank next to last in establishing necessary segregation of duties between board Risk Committees and Audit Committees.

More than half, 57 percent, of respondents are not analyzing the adequacy of cyber insurance coverage or undertaking key activities related to cyber-risk management to help them manage reputational and financial risks associated with the theft of confidential and proprietary data and security breaches. Although boards across geographical regions are consistent in not reviewing cyber-insurance coverage, a very high percentage of respondents from critical-infrastructure sectors, such as the energy/utilities and IT/telecom sectors, indicate that close to 80 percent of their boards of directors do not review insurance for cyber-related risks.

Although Europe leads globally in privacy regulations and enforcement, only 3 percent of the respondents indicate that their organizations have CPOs. The U.S. generally believes it is the global leader in security, but the survey results indicate that North American boards lag behind European and Asian boards in undertaking key activities associated with privacy and security governance such as regular reviews involving annual budgets, roles and responsibilities, and top-level policies.

For more detail, go to:
http://www.cit.cmu.edu/media/press/2012/05_16_executives_managing_cyber_risks.html