KEY ISSUES FOR DIGITAL TRANSFORMATION IN THE G20

Digital security risk has traditionally been approached as a technical problem calling for technical solutions but
the changing nature and scale of digital security risk is driving governments to re-evaluate their strategies and
policies in this area. In the last few years, governments and stakeholders have shifted their focus on the
importance of digital security to minimise the risk to their economic and social activities. This approach
recognises digital security risk as a multifaceted policy area and emphasises the importance of considering this
risk from an economic and social perspective (Figure 33).
Economic and social
prosperity
Technology
Law
enforcement
(Cybercrime)
National and
international
security
The 2015 OECD Council Recommendation on Digital Security Risk Management for Economic and Social
Prosperity (“Security Risk Recommendation”) (OECD, 2015k) reflects this new approach. It calls for the
integration of digital security risk management into an organisation’s overall risk management and decisionmaking
processes. This requires that CEOs, management boards and line managers understand both the
opportunities ICTs can offer in terms of innovation, productivity, and competitiveness, as well as the security
risk they can bring in terms of financial and reputational damages, disruption of operations, loss of innovation,
etc. It also requires that organisations include digital security risk in their existing broader enterprise risk
management governance framework to ensure its continuous and systematic assessment and that appropriate
decisions are made on how to accept, reduce, transfer or avoid this risk. A key aspect of such a governance
framework is the co-operation between economic and social decision makers and ICT security experts.
While the implementation of digital security measures is necessary to reduce digital security risk which can
never be eliminated decisions on the choice of security measures need to be informed by an assessment of
the risk itself, the economic and social objectives and benefits at stake, and the cost and impact of the
measures.
This assessment aims to determine the acceptable level of risk and address the economic and social trade-offs
resulting from the implementation of digital security measures. It is a challenge for organisations. A lack of
appreciation of these trade-offs may result in the adoption of security measures that impose an outsized cost
on an organisation relative to the benefits of reduced risk exposure. Examples include the direct and indirect
cost of security measures, such as opportunity costs and efficiency losses, as well as other negative effects of
security measures on the activities that they aim to protect. In addition, security measures may impose social
costs if they impede the global, open, interconnected and dynamic nature of information and communication