On March 7, a bipartisan bill was introduced to the Senate called the Cybersecurity Disclosure Act of 2017. The bill’s purpose is to “promote transparency in the oversight of cybersecurity risks at publicly traded companies.” It adds Securities and Exchange Commission (SEC) requirements for public companies to disclose what cybersecurity expertise is present within the board of directors.
If no expertise is present, then the company must disclose in its SEC report “what other cybersecurity steps” are being done by the board nominating committee. Whether this bill succeeds in becoming law or not, it is a shot across the bow to executives.
With all this going on, it’s likely that boards and executive leadership are going to be buttonholing their CISOs into cyber-risk conversations. Just a few years ago, security professionals struggled for executive interest (let alone support), but now we are in the hot seat for answers. And what a hot seat it is! A recent survey from Osterman Research reveals that 66% of fired IT professionals were terminated for reasons of security or compliance failures. That’s why we need to make sure leadership understands the relevant security issues and how to help mitigate them.