What Metrics Does The Board Want To Hear From CISO’s? - Seguridad Mania.com - España y América Latina

Not long ago, a board of directors would meet once or twice a year to be briefed on cybersecurity, check the box, and move on. Cybersecurity was little more than an afterthought, and mostly a box-checking exercise for compliance or to make sure the bases were covered in the wake of a newsworthy event. The single biggest responsibility of the board of directors is to protect the company and reduce risk. With little technical understanding at the board level, many were happy to simply throw money at the problem and leave it to IT professionals to handle. But the world has changed substantially in recent years, and some of the most dramatic changes have only come in 2020. Malicious actors are growing more sophisticated. The attack surface and vendor ecosystems have rapidly expanded, refocusing the security conversation towards digital risk and risk tolerance. Boards are increasingly looking at cybersecurity as a crucial part of the business. The problem is, the board doesn’t always know what to look for or how cybersecurity impacts the business.