Amazing insights on cyber | Norman Marks on Governance, Risk Management, and Audit

A couple of recent pieces shed some light, some amazing light, on how cyber-related risk is perceived by executives and the board.

CIO magazine discusses a survey of Australian CEOs and CISOs. They found that:

• …only 6 percent of CEOs say their organisations had suffered a data breach in the last 12 months. This compares to 63 per cent of CISOs who reported breaches in their organisations.
• Almost half (44 per cent) of CEOs felt that their organisations can respond to respond to cyber threats in real time. Unfortunately, their CISOs don’t feel the same way with only 26 per cent indicating that this is the case.
• What the study found is pretty much a disconnect and lack of communication between the two very important roles of CEO and CISO.
• One-third [of CEOs] believe cyber security is an IT or operations issue. So they do not see it as a business priority and as a consequence, they don’t [include] it as part of their business planning.
• 25 per cent of the organisations surveyed that have boards do not report on cyber security to their board members on a regular basis.

This disconnect leads me to a number of suspicions, if not conclusions:

1. If the CEOs didn’t believe their organizations suffered a data breach, the consequences…