What Does Cybersecurity Oversight by Boards Look Like in Practice?

SEC regulations now require that boards of directors for public companies provide oversight of company risks related to cybersecurity. But what does this mean? What is a realistic oversight approach for a board of directors, especially given that they are rarely experts in cybersecurity? The good news is that the requirement is an oversight of risk; not an oversight of cybersecurity programs or implementations.

In this webinar, we will discuss two hypothetical oversight questions of which one is a good example of risk oversight and one of which is a bad example. The bad example question is, "How do you plan to change firewall policies to meet ISO 27001?" This question is too focused on implementation and details best worked out by implementation experts. On the other hand, the good example question is, "Why do you believe that the scope of our ISO 27001 assessment is appropriate for our organization?" This question drives at crucial risk management issues such as whether the chosen security assessment is actually doing any good.

Using these two questions as exploratory frameworks, we will walk through how boards can do their job of representing the shareholders in overseeing cybersecurity risk in the company.