English
- The COVID-19 pandemic has highlighted the importance of cyber resilience to organizations' stability, productivity and survival.
- Cyber-resilience reporting can increase transparency, enhance reputations and foster an organizational culture to combat cyber risk.
- Organizations should develop thoughtful reporting before less effective and more onerous standards are imposed on them.
Almost overnight, COVID-19 has changed the way we work, conduct business and interact with one another, personally and professionally.
With so many people suddenly and unexpectedly working from home and organizations moving to digital business models, cyber resilience has become critical to stability and productivity.
This situation is exacerbated by bad actors taking full advantage of forced digitalization. Attackers are assaulting their targets at dramatically increased rates with phishing, ransomware, fraudulent offers and harassment, including new iterations like “Zoom-bombing”.
Have you read?
In a world of serious strategic risks – pandemics, broad-scale cyberattacks, geopolitical upheaval, climate change – a systemic increase in overall cyber resilience is a necessity. So, how do businesses and organizations speed up cyber resilience-building? By reporting it.
The power of deliberate cyber resilience
Cyber resilience is a matter of survival. Sustainable value generation requires companies – and any type of organization, for that matter – to weather shocks to the system and learn from them. In a post-COVID world, these disturbances are more likely than not to affect a company's digital assets and processes – exactly those assets that have allowed the organization to function during the pandemic.
In a recently published white paper, Cyber Resilience ESG Reporting: Transparency Imperative or Security Nightmare, the authors define cyber resilience as:
an organization's ability to sustainably maintain, build and deliver intended business outcomes despite adverse cyber events. Organizational practices to achieve and maintain cyber resilience must be comprehensive and customized to the whole organization (i.e. including the supply chain). They need to include a formal and properly resourced information security program, team and governance that are effectively integrated with the organization’s risk, crisis, business continuity, and education programs.
First, entities must have in place detailed and actionable enterprise risk, crisis management, data protection and business continuity programs that incorporate cyber and virtual components. Many entities don’t have these essential resilience-building measures in the first place – at least not until they suffer a material crisis.
A close second is building a robust and comprehensive cybersecurity program with effective governance, practices and protocols that are kept up to date, continuously implemented and improved, and which include a laser focus on periodic training and cyber hygiene for all employees and relevant third parties.
This is a big ask for organizations, many of which have just started to understand the importance of cyber resilience. Leaders must step into the shoes of stakeholders and ask the following questions:
- From the employee perspective: Am I cyber-safe working from home?
- From the board perspective: Do we understand our digital risks? Are they managed appropriately?
- From the partner or customer perspective: Is my IP safe from cyberattacks? Can the service be reliably offered?
- From the shareholder and investor perspective: What is my company doing to preserve and protect my ownership interest in an environment of heightened risk?
Adding transparency to the security equation
How do stakeholders know if an entity takes cyber resilience seriously? Currently, they don’t.
In this age of serious and existential risk, thoughtful cyber-resilience reporting is important to creating overall cyber resilience. Why?
- It creates transparency for external stakeholders to allow for more informed decision-making. Stakeholders receive important information about the sustainability of the performance of a company, which allows them to make decisions about whether to buy stock, enter a partnership or purchase a product or service.
- It promotes financial value preservation and creation. Appropriate cyber-resilience programs, practices and talent – and an ability to report on them externally – promote greater trust in a company’s products, services and brand. This, in turn, can lead to earnings above and beyond a competitor who does not have the same trust.
- It contributes to increased internal resilience building. An organization which focuses on cyber-resilience reporting will be better equipped to build a stronger internal culture to combat cyber risk.
- It enhances reputation directly linked to transparency and care. A company that fosters transparency and publicly demonstrates general care and understanding of the expectations of key stakeholders will not only protect its reputation; it may very well create reputational opportunity and intangible value with other external stakeholders, too.
What is the World Economic Forum doing on cybersecurity
The World Economic Forum Platform for Shaping the Future of Cybersecurity and Digital Trust aims to spearhead global cooperation and collective responses to growing cyber challenges, ultimately to harness and safeguard the full benefits of the Fourth Industrial Revolution. The platform seeks to deliver impact through facilitating the creation of security-by-design and security-by-default solutions across industry sectors, developing policy frameworks where needed; encouraging broader cooperative arrangements and shaping global governance; building communities to successfully tackle cyber challenges across the public and private sectors; and impacting agenda setting, to elevate some of the most pressing issues.
Platform activities focus on three main challenges:
Strengthening Global Cooperation for Digital Trust and Security - to increase global cooperation between the public and private sectors in addressing key challenges to security and trust posed by a digital landscape currently lacking effective cooperation at legal and policy levels, effective market incentives, and cooperation between stakeholders at the operational level across the ecosystem.Securing Future Digital Networks and Technology - to identify cybersecurity challenges and opportunities posed by new technologies and accelerate solutions and incentives to ensure digital trust in the Fourth Industrial Revolution.Building Skills and Capabilities for the Digital Future - to coordinate and promote initiatives to address the global deficit in professional skills, effective leadership and adequate capabilities in the cyber domain.
The platform is working on a number of ongoing activities to meet these challenges. Current initiatives include our successful work with a range of public- and private-sector partners to develop a clear and coherent cybersecurity vision for the electricity industry in the form of Board Principles for managing cyber risk in the electricity ecosystem and a complete framework, created in collaboration with the Forum’s investment community, enabling investors to assess the security preparedness of target companies, contributing to raising internal cybersecurity awareness.
For more information, please contact us.
A call to action
Would reporting increase the overall maturity of cyber resilience on a large scale? Thoughtful, properly developed reporting standards could help businesses focus on building cyber resilience – just as financial and ESG disclosure have nudged companies towards more transparent, stakeholder-centric and resilient financial, operational and governance standards.
Transparency will foster a more cyber-resilient future, and some form of reporting akin to ESG reporting is inevitable. Now is the time for the private sector to think this through and develop potential solutions in order to avoid less effective – and more onerous – measures imposed on them in the not-too-distant future.
