“Cyber resilience in an organization must extend beyond the technical IT domain to the domains of people, culture and processes. A company’s protective strategies and practices should apply to everything the company does — to every process on every level, across departments, units and borders — in order to foster an appropriately security-conscious culture.” – Walter Bohmayr and Alexander Türk, The Boston Consulting Group
The World Economic Forum (WEF) is known for its yearly meetings of the global elite held in Davos, Switzerland, as well as its “Global Risks Report,” which is typically released around the same time. Recently, the WEF has taken on a new role on the global scene and is spearheading a global effort to help organizations become more cyber resilient. In January 2017, the WEF released a report entitled “Advancing Cyber-Resilience: Principles and Tools for Boards.”
Getting the Board On Board With Resilience Efforts
Recognizing the key role that business leadership must play to improve cyber resilience, the WEF sought to raise the visibility of this issue to “build a more effective cyber strategy and incorporate it into overall strategic thinking” that encompasses entire systems and industries instead of just leading organizations.
The report noted that while some organizations today have built resilience into their business fabric, being cyber resilient is gaining traction rather slowly among boards of directors. To ensure continued performance, the report explained, organizations must recognize that “resilience as a focus of strategy includes the actions an enterprise takes before, during and after an incident, thereby more fully mitigating potential threats.”
10 Cyber Resilience Principles for Boards of Directors
The report outlines 10 key principles for boards of directors to keep in mind when discussing cyber resilience. The principles are:
A Turning Point
While the concept of cyber resilience is not new, this report marks a turning point of awareness and advises business leaders across the globe to pay attention to one of the key security issues of the decade — and likely many decades to come.