Standards and Guidance Approaches

One set of standards that can be adapted to cybersecurity is from ISO/IEC 27001:2013 Information Technology–Security Techniques–Information Security Management Systems–Requirements. It covers the essential components for the cybersecurity internal organization context from the perspective of its parent, the information security function. These cover management commitment, information security coordination, allocation of information security roles and responsibilities, authorization process for information processing facilities, confidentiality agreements, contact with authorities, contact with special interest groups, independent review of information security, information security in project management, and segregation of duties.

Another voluntary guidance code approach is ISACA’s COBIT 5: Enabling Processes. Its Appendix G is a useful reference and has partly informed the RASCI charts below.

Yet another guidance approach is to adapt the ISO 31000:2009, Risk management—Principles and guidelines standard descriptions of internal context for the purposes of cybersecurity and other risks. (For more detail on ISO 31000, see our Chapter 6, Principles Behind Cyber Risk Management). This serves to aid better understanding between the information security, information technology (IT), and other enterprise functions. ISO 31000 brings internal factors for cybersecurity to the fore, such as objectives-led consideration of the organization’s internal stakeholders, governance and organization structures, standards, contracts, roles and capabilities, culture, information systems, information flows and decision-making processes. (These other factors are also covered in our other chapters.)

Cybersecurity within the Enterprise

To align the cybersecurity function to other enterprise functions is the clarion call required of modern organizations and their leadership. There is no other way an organization can build the speedy, adaptive, resilient, and responsive capabilities required to face the fast-paced evolving universe of cyber threats (and opportunities).

Effective cybersecurity within the modern organization requires a cyber risk management system. This involves the ongoing, effective and fast deployment of organization capabilities to mitigate cyber risk. Waiting to react is game over. The system is not only a framework or set of processes, but the ongoing interplay of many capability elements such as people, technology, policies, procedures, practices, third-party relationships, and culture—that is, all those elements or components that make cybersecurity repeatable, consistent, measureable, demonstrable, and responsive, rather than being overly dependent on the ad-hoc vagaries of individuals, silos, and committees.

The cyber risk management system is a subset and child of the parent enterprise-wide risk management (ERM) system and its governance architecture. It is as simple and complicated as that. There is no need to reinvent the wheel in this regard.

The cyber risk management system has a sibling link to the physical security function and to the business continuity management system (BCMS), which also falls under the same parent enterprise risk management system. Leaving aside for the moment where a cybersecurity function may report to, from a risk governance perspective, it is a part of the normal governance and reporting of the ERM system. If not, serious internal gaps may occur at all levels but especially at the strategic, operational, and interdependency levels. A cyber risk advisory committee (or steering committee or equivalents) may form a working party or task force and will naturally report the outputs from the cyber risk management system in the same way the BCM, security, or ERM systems would to, say, a risk and audit committee up to the board.

Designing Your Own Cyber Risk Function Operating Model

The design of the cybersecurity operating model should be aligned with the ERM function operating model adopted by the enterprise that is already tailored to the organization’s objectives, context, and risk profile. As a guide, the template in Table 15.1 is one way to design and assure that these two operating models could achieve the desired levels of alignment. Its content is illustrative, not prescriptive. Until an ERM function is in place, organizations may make alternative arrangements with other heads of functions, typically security or operations/supply chain.

The modern at-risk organization demands that the CEO (with board oversight) directs the alignment of the key functional roles. This means aligning the cybersecurity function and joint activities across the enterprise with other enterprise functions (and vice versa). Not all functions are equally important to cybersecurity and some may have a critical function at certain times (e.g., corporate communications dealing with external media and social media during a cyber crisis). This involves an understanding of the interfaces between the cybersecurity function and the other functions that need to work together and at times team up, before, during, and after a cyber breach or crisis.

Typical Enterprise Functional Roles Most Involved in Cybersecurity across the Enterprise

Typical enterprise functional roles most involved in the building and measuring of cybersecurity capability across the enterprise are tabled in Table 15.2. The table depicts the broad relationship and hierarchy of the typical cyber-to-enterprise functional roles. These are the key players who need to work together in building and measuring cyber risk management system maturity.

The governance roles are taken up by boards, risk committee(s), and internal audit, and shared by the CEO. The CEO executes strategy and directs executive managers from the CISO across to human resources (HR) with advice from risk committee(s) and/or risk/audit committee who also report to the board and other governance functions.

Aligning Cybersecurity within Enterprise Functions

The CEO (with board oversight) should also direct the alignment of cybersecurity within each key enterprise function. These functions need to interrelate and team up with the cybersecurity function in order to deliver effective cyber risk management.

Tables 15.4 through 15.21 represent each of the above players. They may be used as guideline templates for any organization to tailor per their needs and objectives. They focus on what each of the key enterprise functions and their heads need to do, including cybersecurity under the CISO. As cybersecurity is such a dynamic space, the tables are not meant to be prescriptive and will need revision and tailoring over time. They serve as a useful starting point for debate and framing within any organization as well as a starting point for position description and reward program updates. The only prescription on good governance grounds is that the CISO/DRO should not report to the CIO.

Governance and Risk Oversight Functions for Cybersecurity

Corporate governance and risk oversight roles are taken up by board, risk committee(s), and internal audit reporting to them. The CEO directs management and executes the security strategy encompassing the cybersecurity strategy with advice from risk committee(s) who also report to board and other governance functions. The board of directors and CEO are accountable for overall business and organization performance and they have a fiduciary duty to assess and manage cyber risk. Regulators, including the Securities and Exchange Commission (SEC), have made clear they expect organization top leadership to be engaged on the issue. They can also play a key role in coordinating with critical third parties at an executive-to-executive level.

Leading international practice is to have a risk committee that reports to the full board and report up any cybersecurity matters. Suggested participants are the chairpersons for the board and its subcommittees (such as the audit and finance committee, the operations committee, and the HR committee) and from executive management, the: CEO, CISO/DRO, CIO, CRO, and CFO.

The independent assurance role for cybersecurity is uniquely played by internal audit.

The CEO integrates everything from the boardroom to the server room. The CEO role overlaps the areas of corporate governance and senior executive management. The CEO directs the executive management team from CISO and IT-related management functions right across to people-related functions such as human resources in Table 15.3.

Other key reporting lines to the CEO follow below under both IT-related and enterprise risk-related management functions dealing with cybersecurity.

Executive Management Functions for Cybersecurity

There are several executive management functions interrelated to IT that have a bearing on cybersecurity. But these functions do not all need to report to the CIO, particularly the CISO.

Other Enterprise Management Functions Supporting Cybersecurity

While the above enterprise risk-related management functions are critical partners with the CISO’s function and critical to cybersecurity, other enterprise functions have a critical role to play at times such as a cyber crisis and can lend ongoing support to cybersecurity as well. Their contributions and cooperative interaction with the CISO and CRO functions are important. These extend from legal and compliance across to HR and corporate communications.

Ownership of legal matters fall under a legal counsel and compliance officer. Ownership of compliance matters falls under the head of compliance, who may (or may not) report to the legal counsel. As regulations around cyber develop, legal and compliance roles become increasingly important in keeping other stakeholders informed and engaged. Lawsuits often follow if a cyber incident occurs in certain jurisdictions.

Ownership of organizational strategic matters falls under the CSO.

It is critical that cybersecurity is considered within the overall organization context, including the role of procurement/supply chain and operations functions in performing supplier due diligence and management. Interactions with customers and suppliers can create cybersecurity vulnerabilities. The protections these functions have in place need to be understood if they pose a weak point in an organization’s cyber defenses. This is often reported as not adequately addressed, particularly where critical data is being exchanged. It is also important that these functions maintain daily operations and workplace stability during a cyber event.

Ownership of organizational operational matters falls under the COO.

Ownership of human resource matters falls under the head of Human Resources. Employees are often the weakest link in the cybersecurity chain. Simple errors and accidents—or deliberate actions—by employees can lead to costly cyber incidents. Training on best practices is critical, especially with the rise in sophisticated “spear-phishing” attacks targeting specific employees. Employees must be helped to understand the consequences of failure within the interconnected organizational context.

Ownership of corporate communications matters falls under the head of Corporate Communications.