Cyber security threats aren’t going away.
If anything, as we evolve our use of technology through continued digitisation, they’ll grow.
Acknowledging this escalating risk to public companies and investors, the U.S. Securities and Exchange Commission (SEC) has proposed a new set of Cybersecurity rules aimed at Public Companies that aim to bolster cybersecurity risk management, strategy, governance, and incident disclosure reporting.
These rules are intended to provide more consistent, comparable and decision-useful information so that investors can better evaluate a company’s exposure to cybersecurity risks and incidents; and develop strategies to mitigate those risks and incidents.
Once the rules take effect, publicly listed companies will be required to
This ruling is expected to be finalised imminently, which means that now is a good time to get prepared. It’s time to ensure your company can communicate cyber risk with your stakeholders in an effective way that also aligns with the SECs proposed requirements.
One way to approach this is by using ‘Cyber risk quantification’ as it provides a quantitative view of your company’s cyber risk exposure. Going one step further, an effective cyber risk quantification program should help you achieve the following objectives and answer the following key questions:
Express risk quantitatively: What’s our risk exposure in financial terms to a cyber-attack, and how does this compare against our risk appetite?
Prioritise Investments: What cyber capabilities should we prioritise investment in to optimise our protection against the threats we face?
Demonstrate cost benefit analysis: If we invest £XM in cyber next year, what benefit, in terms of reduced cyber related losses, will this deliver to the business?
Optimise cyber insurance: Do we have appropriate cyber insurance coverage given the threats we face?
Optimise capital investments: Do we have proportionate capital reserves in the event we suffer a widespread cyber incident?
The SECs proposed ruling on cyber risk reporting has likely come at the most relevant time, but an increasing cybersecurity regulatory landscape does mean additional work for many. Have you quantified your organisations cyber risk exposure in the context of the threats faced and capabilities in place?
