- Change in governance and oversight is likely to impact the relationship between the board and the CISO.
- 60% of CISOs will establish critical partnerships with key executives in sales, finance and marketing by 2024, up from less than 20% today.
Many boards of directors are forming dedicated cybersecurity committees that allow for discussion of matters in a confidential environment, led by someone deemed suitably qualified, to ensure that cyber risk receives the attention it deserves, an industry expert said.
Cybersecurity-related risk is rated as the second-highest source of risk for the enterprise, following regulatory compliance risk.
Research firm Gartner predicts that 40 per cent of boards of directors will have a dedicated cybersecurity committee overseen by a qualified board member by 2025, up from less than 10 per cent today.
This is one of several organisational changes Gartner expects to see at the board, management and security team level, in response to the greater risk created by the expanded digital footprint of organisations during the pandemic.
Sam Olyaei, Research Director at Gartner, said that the change in governance and oversight is likely to impact the relationship between the board and the chief information security officer (CISO).
However, he said that relatively few directors feel confident that their company is properly secured against a cyberattack.
“While CISOs should experience more scrutiny as a result, they are also likely to receive more support and resources, according to Gartner. CISOs must expect executive conversations to shift away from performance and health-related discussions to risk-oriented and value-driven exercises,” he said.
Key partners
Gartner also predicts that by 2024, 60 per cent of CISOs will establish critical partnerships with key executives in sales, finance and marketing, up from less than 20 per cent today.
“Effective CISOs realise that heads of sales, marketing and business unit leaders are now key partners as the use of technology and, subsequently, the incurrence of risk happens outside of IT,” Olyaei said.
According to the Gartner CISO Effectiveness Index, top-performing CISOs regularly meet with three times as many non-IT stakeholders as they do IT stakeholders; and they meet with them more frequently than bottom performers.
For asset-intensive enterprises such as utilities, manufacturers and transportation networks, security threats targeting cyber-physical systems present an increasing risk to the organisation.
Bad actors increasingly target weaknesses wherever they are, as demonstrated by the surge in ransomware affecting organizations’ operational systems and recent supply chain attacks.
The siloed nature of today’s security disciplines then becomes its own risk and a liability to the organization, and the IT-centric focus of most security teams needs to expand to include threats in the physical world.
Gartner predicts that by 2025, 50 per cent of asset-intensive organisations will converge their cyber, physical and supply chain security teams under one chief security officer role that reports directly to the CEO.
Remote work can improve access to security talent
Gartner research conducted pre-Covid-19 found that 61 per cent of organisations surveyed were struggling to find and hire security professionals.
“As organisations shifted to remote working in response to the pandemic, it proved that some, if not all, security capabilities could be delivered remotely,” Richard Addiscott, Senior Research Director at Gartner, said.
“This includes security monitoring/operations, policy development, security governance and reporting, security awareness, and incident response via dispersed teams. Cybersecurity teams can work remotely and still provide effective capabilities.”
As a result, Gartner predicts that by 2022, 30 per cent of all security teams will have increased the number of employees working remotely on a permanent basis.
Gartner recommends that security and risk leaders consider adapting their operating models and expand their job advertising to gain access to candidates residing outside of their organisation’s traditional recruitment geographies.