Uncertainty is Widespread Across Companies Over Who Takes the Lead on Cyber: WTW

A majority of executives around the world feel they face a “specialist-generalist” dilemma as to whom leads on cyber resiliency due to its critical nature across the company, but also the recognition that specialization is necessary. This is according to the results of a global survey conducted by The Economist Intelligence Unit (EIU) and sponsored by Willis Towers Watson. The EIU surveyed over 450 companies across the globe about their strategies and the challenges they face in building a cyber resilient organization. Almost 40 percent of executives surveyed felt that the board should oversee cyber, compared with 24 percent who felt it should be the role of a specialized cyber committee. A small portion of respondents surveyed believed it should be the responsibility of audit, risk or some other subgroup.

Source: Willis Towers Watson | Published on September 4, 2018

High angle shot of a hacker cracking a computer code in the dark

The survey also found that communication within leadership roles regarding cybersecurity risks is also inconsistent:

  • Only 8% of executives say that their CISO or equivalent performs above average in communicating the financial, workforce, reputational or personal consequences of cyber threats.
  • Less than a quarter of executives say that their cyber resilience board briefings are “well above average”.
  • Under 15% give their CISOs or equivalent a top rating from a scale of one to ten.

“It is no surprise that one of the main challenges companies face when implementing a cyber risk mitigation or resiliency plan is the communication gap between the board and the CISO,” says Anthony Dagostino, global head of cyber risk with Willis Towers Watson. “Cyber resiliency starts with the board because they understand risk and can help their organizations set the appropriate strategy to effectively mitigate that risk. However, while CISOs are security specialists, most of them still struggle with adequately translating security threats into operational and financial impact to their organizations- which is what boards want to understand. To close this communication gap, CISOs need tools that can help them quantify and translate the vulnerabilities uncovered from their cybersecurity maturity assessments. These tools enable them to better communicate the risk to the board, seek adequate budget, and enable the board to provide meaningful guidance”.

According to the survey, the specialist-generalist dilemma is not only faced at the board level, as cyber requires specialist knowledge and skills along with enterprise-wide business, workforce and process capabilities. For example, as workforce vulnerabilities contribute to most cyber incidents, two-thirds of companies surveyed believe HR and Information Security partnership is key. When asked whom takes a lead role in developing employee-related cyber risk policies, 54% said HR leads with Information Security advising and 28% said Information Security leads with HR advising. “These findings are encouraging because they signal that more organizations are involving their HR function in addressing cyber risk. Still, organizations need greater collaboration between their CHROs and their CISOs to truly assess the organizational culture driving cyber risk in the first instance. The solution isn’t always more security awareness training. It could be a leadership or incentives and rewards issue, things that fall squarely within the function of the CHRO,” Dagostino added.

Some other key findings around leadership responsibilities for cyber include:

  • Three out of the four regions surveyed believe that the “board as a whole” should oversee cyber risk, while Europe believes it should be a dedicated cyber group.
  • Only 30 percent of executives believe they have enough directors that understand cyber risks and only 23 percent are actively recruiting directors who understand those risks.
  • In all regions except the UK, the heads of cyber-resilience report to the CEO. In the UK, most report to the board.

For more insights on executive leadership on corporate cybersecurity concerns, read the our full report: How boards can lead the cyber-resilient organisation.

About Willis Towers Watson

Willis Towers Watson is a leading global advisory, broking and solutions company that helps clients around the world turn risk into a path for growth. With roots dating to 1828, Willis Towers Watson has over 40,000 employees serving more than 140 countries. We design and deliver solutions that manage risk, optimize benefits, cultivate talent, and expand the power of capital to protect and strengthen institutions and individuals. Our unique perspective allows us to see the critical intersections between talent, assets and ideas — the dynamic formula that drives business performance. Together, we unlock potential.

About Willis Towers Watson Cyber

Willis Towers Watson takes a holistic approach to cyber risk management and resiliency, with the understanding that a complete corporate solution addresses and incorporates people, capital, and technologystrategies. Our cyber experts have decoded the complexity of the current cyber threat landscape to deliver this integrated perspective to major enterprises across sectors. As a global leader in human capital solutions, risk advisory and broking, we are well prepared to assess an organization's cyber vulnerabilities, providing protection through best-in-class solutions and mitigating the risk of future attacks.

Related Articles:

Are you retail Agent Looking for a Quote?