To be a company director you are expected to ask the right questions of the right executives in the company, and understand the answers so you can challenge them if they don’t sound right. You need to do that in cyber security too.
Ciaran Martin, NCSC CEO, CBI Cyber Security Conference, 12 September 2018
Cyber literacy in the board room is as important as financial literacy.
However, in our conversations with business leaders it is clear that one of the most common and persistent misconceptions is that cyber security is a complex subject.
CISOs and technical teams are one of the greatest assets any organisation has, and their role in improving your knowledge of relevant cyber security issues shouldn’t be underestimated. For this reason, the NCSC have worked to identify a range of questions which we believe will help generate the right discussions between board members and their CISOs and, importantly, increase awareness of key topics in cyber security.
To help start the conversation within your organisation, we are publishing five of these questions with some elements you would look for in a response. The questions are not designed to try and catch CISOs or technical teams out. Rather, we want to open up the discussion about what your organisation is doing to get the cyber security basics right. We hope that by asking these questions, anything blocking those basics (for example a wider organisational policy) will be brought to the surface and addressed. Obviously, these are not the only questions to ask and nor are the possible answers exhaustive, but they illustrate the types of things which are important, and the reasons why.
Later this year we will be publishing a board toolkit. Part of that will include a broader set of questions. So we are really keen to hear your feedback on the questions published today. If you have any experiences to share on how you have approached these topics within your organisations, please do get in touch.
Finally, thank you to all those who have already been in touch over the summer to help with testing elements of the full toolkit. We will be in touch towards the end of September to seek your views as we start testing further content.
Sarah L
Deputy Director, Economy and Society
Source: National Cyber Security Centre
