ARLINGTON, Va. and LONDON, Sept. 05, 2018 (GLOBE NEWSWIRE) -- A majority of executives around the world feel they face a “specialist-generalist” dilemma as to whom leads on cyber resiliency due to its critical nature across the company, but also the recognition that specialization is necessary. This is according to the results of a global survey conducted by The Economist Intelligence Unit (EIU) and sponsored by Willis Towers Watson. The EIU surveyed over 450 companies across the globe about their strategies and the challenges they face in building a cyber resilient organization. Almost 40 percent of executives surveyed felt that the board should oversee cyber, compared with 24 percent who felt it should be the role of a specialized cyber committee. A small portion of respondents surveyed believed it should be the responsibility of audit, risk or some other subgroup.
The survey also found that communication within leadership roles regarding cybersecurity risks is also inconsistent:
- Only 8% of executives say that their CISO or equivalent performs above average in communicating the financial, workforce, reputational or personal consequences of cyber threats.
- Less than a quarter of executives say that their cyber resilience board briefings are “well above average”.
- Under 15% give their CISOs or equivalent a top rating from a scale of one to ten.
“It is no surprise that one of the main challenges companies face when implementing a cyber risk mitigation or resiliency plan is the communication gap between the board and the CISO,” says Anthony Dagostino, global head of cyber risk with Willis Towers Watson. “Cyber resiliency starts with the board because they understand risk and can help their organizations set the appropriate strategy to effectively mitigate that risk. However, while CISOs are security specialists, most of them still struggle with adequately translating security threats into operational and financial impact to their organizations- which is what boards want to understand. To close this communication gap, CISOs need tools that can help them quantify and translate the vulnerabilities uncovered from their cybersecurity maturity assessments. These tools enable them to better communicate the risk to the board, seek adequate budget, and enable the board to provide meaningful guidance.”
According to the survey, the specialist-generalist dilemma is not only faced at the board level, as cyber requires specialist knowledge and skills along with enterprise-wide business, workforce and process capabilities. For example, as workforce vulnerabilities contribute to most cyber incidents, two-thirds of companies surveyed believe HR and Information Security partnership is key. When asked whom takes a lead role in developing employee-related cyber risk policies, 54% said HR leads with Information Security advising and 28% said Information Security leads with HR advising. “These findings are encouraging because they signal that more organizations are involving their HR function in addressing cyber risk. Still, organizations need greater collaboration between their CHROs and their CISOs to truly assess the organizational culture driving cyber risk in the first instance. The solution isn’t always more security awareness training. It could be a leadership or incentives and rewards issue, things that fall squarely within the function of the CHRO,” Dagostino added.
Some other key findings around leadership responsibilities for cyber include:
- 3 out of the 4 regions surveyed believe that the “board as a whole” should oversee cyber risk, while Europe believes it should be a dedicated cyber group.
- Only 30 percent of executives believe they have enough directors that understand cyber risks and only 23 percent are actively recruiting directors who understand those risks.
- In all regions except the UK, the heads of cyber-resilience report to the CEO. In the UK, most report to the board.
For more insights on executive leadership on corporate cybersecurity concerns, the full report may be downloaded here.
About Willis Towers Watson
Willis Towers Watson (NASDAQ: WLTW) is a leading global advisory, broking and solutions company that helps clients around the world turn risk into a path for growth. With roots dating to 1828, Willis Towers Watson has over 40,000 employees serving more than 140 countries. We design and deliver solutions that manage risk, optimize benefits, cultivate talent, and expand the power of capital to protect and strengthen institutions and individuals. Our unique perspective allows us to see the critical intersections between talent, assets and ideas — the dynamic formula that drives business performance. Together, we unlock potential. Learn more at willistowerswatson.com.
About Willis Towers Watson Cyber
Willis Towers Watson takes a holistic approach to cyber risk management and resiliency, with the understanding that a complete corporate solution addresses and incorporates people, capital, and technology strategies. Our cyber experts have decoded the complexity of the current cyber threat landscape to deliver this integrated perspective to major enterprises across sectors. As a global leader in human capital solutions, risk advisory and broking, we are well prepared to assess an organization's cyber vulnerabilities, providing protection through best-in-class solutions and mitigating the risk of future attacks. Explore comprehensive cybersecurity solutions at willistowerswatson.com/cyber.
Media contacts
Diana Alickaj +1 646 395 6323
willistowerswatson@cognitomedia.com
Benjamin Theile-Long +44 (0) 20 7426 9406
willistowerswatson@cognitomedia.com