The notion that the C-suite doesn’t care about cybersecurity is, at this point, relatively dated. Even the densest executives have at least some concept of why it’s important to keep corporate devices and data safe. At the same time, security is a complex topic, filled with technicalities and often laden with technicalities.
As a CISO, it falls to you to establish clearly-understandable metrics and language that allow you to make your case to the board, whether you’re discussing a current security deployment or presenting them with a new threat profile.
One of the best strategies in this regard is to use the same sort of language commonly used in describing other business risks. Most senior executives are quire familiar with concepts such as negative impacts and risk probability, so using such an approach and terminology will go a long way towards helping them understand the bigger picture and make more informed security decisions. While you shouldn’t lead with technical details, you should come prepared to explain them in understandable and easily-digestible terms.
The goal here is to demonstrate to the board of directors how cybersecurity fits into a broader enterprise risk management approach and rid them of any notion that cybersecurity is solely the domain of technical professionals.
Senior management also tends to embrace maturity models, as they’re familiar with them from quality management programs. With that in mind, it’s important that you make a clear distinction between performance and program maturity metrics. Although you do need to track both, the latter is a better measure of your ability to manage risk – performance metrics only show incidents such as compromised or overused passwords, whilst maturity metrics allow you to more deeply explore your evaluation process.
You may also choose to highlight precisely how your program monitors worker adherence to security policies and provide the board with access to records that support your statements.
Cybersecurity is a people, process, and technology issue. This is something you know full well, and it’s also something you need to convey to senior management. Explaining to them how all three elements work together to reduce risk is useful, particularly from a program maturity standpoint.
Measuring and analyzing the three pillars in this way allows your company to make a strategic choice about both security leadership and risk management. Assist senior management in understanding why the orchestration of people, processes, and technology is essential for a successful cybersecurity initiative. Emphasize that they must play an active role in this approach.
Creating a culture of cybersecurity requires participation from leadership, including department heads. Not only are they the guiding force behind your business, but they also play a critical role in ensuring all processes are practical in nature and easy to integrate into existing workflows. And if in discussions surrounding your policy ideas, someone disagrees with one of your decisions, you should treat that as a good thing.
Their concern may well be a valid one, something you missed due to your unfamiliarity with how a particular department operates. By striving for cross-functional, inter-organizational support, you’ll be able to provide practical answers to any questions from the board or the CEO. You can also make the case for where it’s most efficient to direct security spending.
Finally, frameworks such as NIST or ISO27001 provide a common risk assessment language with which senior executives and board members should be familiar. Constructing your program with this framework clearly illustrates to them how your efforts perform compared to other companies. This will, in turn, allow you to make a comprehensive, cohesive statement with easily-verified data.
Talking to the C-suite can seem a daunting task, but it doesn’t have to be. By understanding knowledge gaps and presenting your case in a way that’s understandable to leadership, you can ensure that they gain a firm grasp of your organization’s cybersecurity posture. Perhaps more importantly, you can also drum up support for whatever security initiatives your business needs.