The Cyber Defense eMagazine November Edition for 2023

previously disclosed incidents each quarter, annually report on cybersecurity risk management strategy
and adopt controls to mitigate cyber risk.
Although these new rules and guidelines may seem excessive to some, they’re an essential step towards
a stronger and more proactive approach to cyber risk management. Let’s look at a few key takeaways
from this ruling and what they might mean to your organization.
1) Organizations should always be audit ready and then some.
The primary concern many organizations may have with these new rules is the requirement to report a
material incident within four days. This can be difficult if you don’t have integrated systems that share
and aggregate data. This can lead to delays in investigations and potentially missing the required
disclosure date. To accomplish the new rule’s requirements, organizations need to be proactive in
collecting data and continuously monitoring their controls. The bottom line is that auditors and hackers
are looking for the same thing - control failures. If organizations are continuously monitoring and testing
for them, it’s less likely hackers will find an opening, meaning that audit-ready organizations that are also
incident-ready!
Being audit-ready means having a holistic approach to security and compliance that includes risk
assessment, real-time continuous compliance monitoring, training for employees and effective
communication. Having these critical pieces in place and automating the right processes is extremely
important for organizations in the wake of this rule because it enables them to meet the reporting
requirements faster, with less effort, and with less disruption to ongoing activity.
To have the best understanding of where risk lies in the business, organizations should leverage a risk
management and compliance tool. By auditing against compliance standards, organizations are able to
see where their inherent business risk lies, and in turn, make decisions to remediate that risk and reduce
exposure. Additionally, a robust risk management tool will allow security leaders to quickly understand,
evaluate and convey the impact of risk on the business aspects they care about the most.
2) Boards need to have a deeper understanding of cyber risk and security than ever before.
Part of the rule requires companies to disclose how much the board knows about cybersecurity and how
their organization is implementing cybersecurity tactics and best practices. This begins with general
education on cybersecurity and the current threat landscape. Organizations can accomplish this with
trainings, providing educational materials or appointing an expert in cybersecurity to the board to help
guide conversations. This foundational step is critical to acting with purpose.
It’s also essential to consider the board members’ awareness of what’s going on within the organization,
what initiatives are currently in place and what risks impact success. To do this effectively, security
leaders must translate cyber risk and its impact into a language that board members will understand –
dollars and cents.
Cyber Defense eMagazine – November 2023 Edition 174
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.