- The COVID-19 pandemic has highlighted the importance of cyber resilience to organizations' stability, productivity and survival.
- Cyber-resilience reporting can increase transparency, enhance reputations and foster an organizational culture to combat cyber risk.
- Organizations should develop thoughtful reporting before less effective and more onerous standards are imposed on them.
Almost overnight, COVID-19 has changed the way we work, conduct business and interact with one another, personally and professionally.
With so many people suddenly and unexpectedly working from home and organizations moving to digital business models, cyber resilience has become critical to stability and productivity.
This situation is exacerbated by bad actors taking full advantage of forced digitalization. Attackers are assaulting their targets at dramatically increased rates with phishing, ransomware, fraudulent offers and harassment, including new iterations like “Zoom-bombing”.
Have you read?
In a world of serious strategic risks – pandemics, broad-scale cyberattacks, geopolitical upheaval, climate change – a systemic increase in overall cyber resilience is a necessity. So, how do businesses and organizations speed up cyber resilience-building? By reporting it.
The power of deliberate cyber resilience
Cyber resilience is a matter of survival. Sustainable value generation requires companies – and any type of organization, for that matter – to weather shocks to the system and learn from them. In a post-COVID world, these disturbances are more likely than not to affect a company's digital assets and processes – exactly those assets that have allowed the organization to function during the pandemic.
In a recently published white paper, Cyber Resilience ESG Reporting: Transparency Imperative or Security Nightmare, the authors define cyber resilience as:
an organization's ability to sustainably maintain, build and deliver intended business outcomes despite adverse cyber events. Organizational practices to achieve and maintain cyber resilience must be comprehensive and customized to the whole organization (i.e. including the supply chain). They need to include a formal and properly resourced information security program, team and governance that are effectively integrated with the organization’s risk, crisis, business continuity, and education programs.
First, entities must have in place detailed and actionable enterprise risk, crisis management, data protection and business continuity programs that incorporate cyber and virtual components. Many entities don’t have these essential resilience-building measures in the first place – at least not until they suffer a material crisis.
A close second is building a robust and comprehensive cybersecurity program with effective governance, practices and protocols that are kept up to date, continuously implemented and improved, and which include a laser focus on periodic training and cyber hygiene for all employees and relevant third parties.
This is a big ask for organizations, many of which have just started to understand the importance of cyber resilience. Leaders must step into the shoes of stakeholders and ask the following questions:
- From the employee perspective: Am I cyber-safe working from home?
- From the board perspective: Do we understand our digital risks? Are they managed appropriately?
- From the partner or customer perspective: Is my IP safe from cyberattacks? Can the service be reliably offered?
- From the shareholder and investor perspective: What is my company doing to preserve and protect my ownership interest in an environment of heightened risk?
Adding transparency to the security equation
How do stakeholders know if an entity takes cyber resilience seriously? Currently, they don’t.
In this age of serious and existential risk, thoughtful cyber-resilience reporting is important to creating overall cyber resilience. Why?
- It creates transparency for external stakeholders to allow for more informed decision-making. Stakeholders receive important information about the sustainability of the performance of a company, which allows them to make decisions about whether to buy stock, enter a partnership or purchase a product or service.
- It promotes financial value preservation and creation. Appropriate cyber-resilience programs, practices and talent – and an ability to report on them externally – promote greater trust in a company’s products, services and brand. This, in turn, can lead to earnings above and beyond a competitor who does not have the same trust.
- It contributes to increased internal resilience building. An organization which focuses on cyber-resilience reporting will be better equipped to build a stronger internal culture to combat cyber risk.
- It enhances reputation directly linked to transparency and care. A company that fosters transparency and publicly demonstrates general care and understanding of the expectations of key stakeholders will not only protect its reputation; it may very well create reputational opportunity and intangible value with other external stakeholders, too.
What is the World Economic Forum doing on cybersecurity?
The World Economic Forum’s Centre for Cybersecurity is leading the global response to address systemic cybersecurity challenges and improve digital trust. The centre is an independent and impartial platform committed to fostering international dialogues and collaboration on cybersecurity in the public and private sectors.
Since its launch, the centre has driven impact throughout the cybersecurity ecosystem:
- Training a new generation of cybersecurity experts
Salesforce, Fortinet and the Global Cyber Alliance, in partnership with the Forum, are delivering free and globally accessible training through the Cybersecurity Learning Hub.
- Building a global response to cybersecurity risks
The Forum, in collaboration with the University of Oxford – Oxford Martin School, Palo Alto Networks, Mastercard, KPMG, Europol, European Network and Information Security Agency, and the US National Institute of Standards and Technology, is identifying future global risks from next-generation technology.
- Improving cybersecurity in the aviation industry
Through the Cyber Resilience in the Aviation Industry initiative, the centre has been improving cyber resilience in aviation in collaboration with Deloitte and more than 50 other companies and international organizations.
- Making the global electricity ecosystem more cyber resilient
The centre and the Platform for Shaping the Future of Energy, Materials and Infrastructure have been bringing together leaders from more than 50 businesses, governments, civil society and academia to develop a clear and coherent cybersecurity vision for the electricity industry.
- The Council on the Connected World agreed on IoT security requirements for consumer-facing devices to protect them from cybers threats, calling on the world’s biggest manufacturers and vendors to take action for better IoT security.
- The Forum is also a signatory of the Paris Call for Trust and Security in Cyberspace, which aims to ensure global digital peace and security.
Contact us for more information on how to get involved.
A call to action
Would reporting increase the overall maturity of cyber resilience on a large scale? Thoughtful, properly developed reporting standards could help businesses focus on building cyber resilience – just as financial and ESG disclosure have nudged companies towards more transparent, stakeholder-centric and resilient financial, operational and governance standards.
Transparency will foster a more cyber-resilient future, and some form of reporting akin to ESG reporting is inevitable. Now is the time for the private sector to think this through and develop potential solutions in order to avoid less effective – and more onerous – measures imposed on them in the not-too-distant future.