How to bridge the cybersecurity knowledge gap with your board of directors: Six effective strategies

Board education sessions don’t happen enough. By meeting quarterly, technology leaders can share the top cybersecurity threats facing their industry and their organization specifically. Topics of conversation should also include where the company is lacking in security measures and whether it has had any close calls with cybersecurity breaches. These sessions will provide the board with an opportunity to learn more about the cybersecurity landscape while asking technology leaders business risk questions to assess what the company needs to do to minimize threats and close calls.

Boards should be asking questions like, what are the top three current security incidents in the industry, could they apply to us, and how are we mitigating those risks for our company? By fostering strong communication and knowledge-sharing between your board and cyber teams, you can build a solid foundation for robust cybersecurity measures that protect your organization from evolving threats.

If you’re wondering how to better explain cybersecurity measures to the board, using common-sense, risk-based metrics is a good option. Boards require metrics that will help drive actionable decisions around cybersecurity. Instead of complicated dashboards with dozens of KPIs, it’s important to focus on key metrics such as:

• How much has the company spent on cybersecurity per employee and how does that compare to industry benchmarks?
• How many cybersecurity close calls have occurred?
• What were the lessons learned from these close calls?
• How many cybersecurity issues have occurred relative to industry averages?
• How many cybersecurity issues have been repeat incidents?
• When a security issue occurs, how quickly has the organization been able to recover?
• What are the number of human hours spent on security issues?
• What is the mix of spending relative to mitigation of top industry threats?
• What is the organization’s security posture and how will it evolve with upcoming business initiatives?

These metrics allow technology leaders to paint a realistic picture of the company’s security posture, giving boards an accurate depiction of the current threat landscape. Comparing company metrics to industry averages is key to getting an understanding of how the organization fares alongside its peers.

The threat landscape has become unmanageable and technology teams need to be able to communicate their experiences and provide a realistic view of the current situation with the board—this requires a safe space for open discussions about risk.  

This strategy involves a cultural shift within the organization, starting with setting the tone at the top and trickling down to every level. Technology leaders and board members need to be able to speak transparently about pressing cybersecurity issues, openly acknowledge risks, and collaboratively develop solutions to enhance the company’s security posture. Without these open conversations board members won’t be able to determine whether the company is investing adequate resources in the right areas.

After all, nothing is ever perfect, and in the world of cybersecurity, risks should be expected. If everything appears perfect, it begs the question: what is the most likely area of exposure? And what are we doing about it?

It’s important for organizations to have an industry benchmark of cybersecurity spending to determine if they’re keeping pace with their peers and making adequate investments in security measures. Spending on cybersecurity doesn’t have to be linear along with company growth, organizations do have to adjust their spending when there are major changes in the business, such as the addition of new employees or entry into new geographical markets. Strategic investments should target what is most valuable and what is most likely to be targeted by cyberattacks to maximize security effectiveness.

Discussions around the cost of a cyber breach are also important to have with the board. Consider conducting an analysis of the cost of a breach in comparison the cost of security investments. Factors such as reputational damage, the cost to remediate, and potential lost sales should be carefully considered to make informed decisions on cybersecurity spending.

The board of directors should fulfill a supportive role during cybersecurity incidents. They should be regularly updated on the progress of the incident and have a clear understanding of key decisions being made. In the event of a breach, the board can offer invaluable guidance regarding the risk appetite for the company. Organizations that involve the board in discussions around financial implications, systems availability, paying ransomware, hiring additional IT employees, or buying additional cybersecurity products benefit greatly from the board’s business expertise.

This strategy can completely transform how you discuss cybersecurity measures with the board. As technical backgrounds are lacking in most boards today, we advise organizations to prioritize tech and cyber competent individuals when it is time to select a new board member. As a result, the conversation can take on both a risk and technical focus.