As the digital landscape rapidly evolves, cybersecurity has transcended from a mere technical issue to a critical element of corporate governance. For boards of directors, understanding and addressing cyber risk is now paramount. Yet, many boards still make the mistake of relegating cybersecurity oversight solely to the audit committee—already tasked with an extensive range of responsibilities. Given the growing complexity of cyber threats and their potential impact on business continuity, reputation, and finances, boards must rethink their approach to cyber risk oversight.
The Overloaded Audit Committee
Audit committees have long been responsible for overseeing financial reporting, internal controls, and regulatory compliance. In recent years, however, their scope has expanded to encompass an increasingly complex set of risks—enterprise risk management (ERM), environmental, social, and governance (ESG) issues, and now, cybersecurity.
According to the National Association of Corporate Directors (NACD) 2024 Audit Committee Practices Report, cybersecurity and ERM are now top priorities for audit committees, particularly for public companies. While audit committees do address cybersecurity, the growing complexity of the issue suggests that creating a dedicated cybersecurity committee could improve focus and enable more effective risk management.
With the range of issues that audit committees must address, cybersecurity should not be just another item on their already full agenda. Cybersecurity involves much more than safeguarding IT systems; it entails protecting the entire organization from evolving threats, including data breaches, cyberattacks, and emerging technologies such as artificial intelligence and machine learning. These risks impact all areas of the business—from operations and customer relations to financial stability and brand integrity.
Given the diverse array of responsibilities within the audit committee, cybersecurity oversight cannot remain a secondary priority. Boards should consider establishing specialized cybersecurity committees with dedicated resources and expertise to manage this critical risk.
The Case for a Cybersecurity Committee
Some boards are already recognizing the need for more focused cybersecurity risk oversight by establishing dedicated cybersecurity committees. These committees ensure that cybersecurity receives the attention it deserves and provides strategic oversight with specialized expertise. NACD’s findings indicate that an increasing number of companies are adopting a cybersecurity committee model to enhance board-level oversight of cyber threats. This approach not only ensures proper focus on cybersecurity but also aligns it with broader business goals.
For example, Xerox and General Electric have established dedicated cybersecurity committees that operate alongside their audit and risk committees. These committees focus specifically on cybersecurity, enabling more detailed oversight and better-informed decision-making. This model ensures that cybersecurity risks are addressed at the board level and allows for the alignment of cyber risk with the organization’s overall strategy.
Similarly, Bristol-Myers Squibb has a subcommittee exclusively dedicated to cybersecurity, which reports directly to the full board. This subcommittee works closely with cybersecurity experts and executives, offering strategic guidance on managing and mitigating cyber threats.
What Boards Are Getting Wrong
Boards that fail to create separate cybersecurity oversight are missing an opportunity to strengthen their overall risk management strategy. Without a dedicated focus, boards may struggle to keep up with increasingly sophisticated cyber threats, leaving their organizations vulnerable. A failure to adapt traditional, high-level risk management approaches to the dynamic nature of cyber risk can expose a company to substantial financial, operational, and reputational damage.
A cybersecurity committee provides focused oversight in several key areas:
- Cybersecurity Strategy: Ensuring that the organization develops and implements a proactive, evolving cybersecurity strategy aligned with business objectives.
- Risk Assessment: Evaluating and addressing current and emerging cyber threats to ensure the company is prepared to respond quickly and effectively.
- Resource Allocation: Making informed decisions on investments in the necessary technology, talent, and processes to combat cyber risks.
- Regulatory Compliance: Ensuring the company meets evolving legal and regulatory requirements related to cybersecurity, including data protection and privacy laws.
- Incident Response: Overseeing the organization’s preparedness and ability to respond swiftly to cyberattacks and data breaches, minimizing the impact on operations and reputation.
A Call to Action for Boards
Boards must recognize that cybersecurity oversight is no longer just a task for the audit committee. It requires dedicated attention, resources, and specialized expertise. Establishing a cybersecurity committee is about more than compliance; it’s about fostering a proactive culture of risk management and resilience throughout the organization.
Boards should start by:
- Evaluating Current Oversight: Assess whether their current cybersecurity oversight is sufficient. If cybersecurity is still under the audit committee, is the focus adequate given the scale of the risk?
- Allocating Resources: Ensure the cybersecurity committee, if established, has the necessary resources and access to both internal and external expertise.
- Engaging with Experts: Cybersecurity is a specialized field that requires deep knowledge. Boards should seek external advisors with expertise to help navigate the evolving landscape of cyber risks.
- Reviewing Strategies Regularly: As cyber threats evolve rapidly, it is crucial to regularly revisit and refine the company’s cybersecurity strategy and response protocols to stay ahead of new risks.
Conclusion
As cyber threats become more complex and pervasive, boards must take a more proactive and strategic approach to cybersecurity oversight. Continuing to rely on the audit committee to manage cybersecurity risks leaving the organization vulnerable. It’s time to establish dedicated cybersecurity committees that can focus on managing these risks effectively. By doing so, boards will protect not only their companies but also their reputations, financial stability, and long-term success in an increasingly digital world.
Ken Stasiak has led countless cybersecurity sessions for boards and executives, helping them navigate complex risks and enhance their strategies. He’s available to assist in creating and developing cybersecurity subcommittees tailored to your organization’s needs. Additionally, Ken can sit on your board as an advisor, offering expert guidance on cybersecurity governance. Let’s work together to build a strong governance model and ensure your board is prepared to tackle today’s cybersecurity challenges.
