- The COVID-19 pandemic has highlighted the importance of cyber resilience to organizations' stability, productivity and survival.
- Cyber-resilience reporting can increase transparency, enhance reputations and foster an organizational culture to combat cyber risk.
- Organizations should develop thoughtful reporting before less effective and more onerous standards are imposed on them.
Almost overnight, COVID-19 has changed the way we work, conduct business and interact with one another, personally and professionally.
With so many people suddenly and unexpectedly working from home and organizations moving to digital business models, cyber resilience has become critical to stability and productivity.
This situation is exacerbated by bad actors taking full advantage of forced digitalization. Attackers are assaulting their targets at dramatically increased rates with phishing, ransomware, fraudulent offers and harassment, including new iterations like “Zoom-bombing”.
Have you read?
In a world of serious strategic risks – pandemics, broad-scale cyberattacks, geopolitical upheaval, climate change – a systemic increase in overall cyber resilience is a necessity. So, how do businesses and organizations speed up cyber resilience-building? By reporting it.
The power of deliberate cyber resilience
Cyber resilience is a matter of survival. Sustainable value generation requires companies – and any type of organization, for that matter – to weather shocks to the system and learn from them. In a post-COVID world, these disturbances are more likely than not to affect a company's digital assets and processes – exactly those assets that have allowed the organization to function during the pandemic.
In a recently published white paper, Cyber Resilience ESG Reporting: Transparency Imperative or Security Nightmare, the authors define cyber resilience as:
an organization's ability to sustainably maintain, build and deliver intended business outcomes despite adverse cyber events. Organizational practices to achieve and maintain cyber resilience must be comprehensive and customized to the whole organization (i.e. including the supply chain). They need to include a formal and properly resourced information security program, team and governance that are effectively integrated with the organization’s risk, crisis, business continuity, and education programs.
First, entities must have in place detailed and actionable enterprise risk, crisis management, data protection and business continuity programs that incorporate cyber and virtual components. Many entities don’t have these essential resilience-building measures in the first place – at least not until they suffer a material crisis.
A close second is building a robust and comprehensive cybersecurity program with effective governance, practices and protocols that are kept up to date, continuously implemented and improved, and which include a laser focus on periodic training and cyber hygiene for all employees and relevant third parties.
This is a big ask for organizations, many of which have just started to understand the importance of cyber resilience. Leaders must step into the shoes of stakeholders and ask the following questions:
- From the employee perspective: Am I cyber-safe working from home?
- From the board perspective: Do we understand our digital risks? Are they managed appropriately?
- From the partner or customer perspective: Is my IP safe from cyberattacks? Can the service be reliably offered?
- From the shareholder and investor perspective: What is my company doing to preserve and protect my ownership interest in an environment of heightened risk?
Adding transparency to the security equation
How do stakeholders know if an entity takes cyber resilience seriously? Currently, they don’t.
In this age of serious and existential risk, thoughtful cyber-resilience reporting is important to creating overall cyber resilience. Why?
- It creates transparency for external stakeholders to allow for more informed decision-making. Stakeholders receive important information about the sustainability of the performance of a company, which allows them to make decisions about whether to buy stock, enter a partnership or purchase a product or service.
- It promotes financial value preservation and creation. Appropriate cyber-resilience programs, practices and talent – and an ability to report on them externally – promote greater trust in a company’s products, services and brand. This, in turn, can lead to earnings above and beyond a competitor who does not have the same trust.
- It contributes to increased internal resilience building. An organization which focuses on cyber-resilience reporting will be better equipped to build a stronger internal culture to combat cyber risk.
- It enhances reputation directly linked to transparency and care. A company that fosters transparency and publicly demonstrates general care and understanding of the expectations of key stakeholders will not only protect its reputation; it may very well create reputational opportunity and intangible value with other external stakeholders, too.
What is the World Economic Forum doing on cybersecurity
The World Economic Forum's Centre for Cybersecurity is leading the global response to address systemic cybersecurity challenges and improve digital trust. We are an independent and impartial global platform committed to fostering international dialogues and collaboration on cybersecurity in the public and private sectors. We bridge the gap between cybersecurity experts and decision makers at the highest levels to reinforce the importance of cybersecurity as a key strategic priority.
Our community has three key priorities:
Strengthening Global Cooperation - to increase global cooperation between public and private stakeholders to foster a collective response to cybercrime and address key security challenges posed by barriers to cooperation.
Understanding Future Networks and Technology - to identify cybersecurity challenges and opportunities posed by new technologies, and accelerate forward-looking solutions.
Building Cyber Resilience - to develop and amplify scalable solutions to accelerate the adoption of best practices and increase cyber resilience.
Initiatives include building a partnership to address the global cyber enforcement gap through improving the efficiency and effectiveness of public-private collaboration in cybercrime investigations; equipping business decision makers and cybersecurity leaders with the tools necessary to govern cyber risks, protect business assets and investments from the impact of cyber-attacks; and enhancing cyber resilience across key industry sectors such as electricity, aviation and oil & gas. We also promote mission aligned initiatives championed by our partner organizations.
The Forum is also a signatory of the Paris Call for Trust and Security in Cyberspace which aims to ensure digital peace and security which encourages signatories to protect individuals and infrastructure, to protect intellectual property, to cooperate in defense, and refrain from doing harm.
For more information, please contact us.
A call to action
Would reporting increase the overall maturity of cyber resilience on a large scale? Thoughtful, properly developed reporting standards could help businesses focus on building cyber resilience – just as financial and ESG disclosure have nudged companies towards more transparent, stakeholder-centric and resilient financial, operational and governance standards.
Transparency will foster a more cyber-resilient future, and some form of reporting akin to ESG reporting is inevitable. Now is the time for the private sector to think this through and develop potential solutions in order to avoid less effective – and more onerous – measures imposed on them in the not-too-distant future.