Effective Reporting to the BoD on Critical Assets, Cyberthreats and Key Controls: The Qualitative and Quantitative Model

 

 

Because the BoD is responsible for overseeing the management of an enterprise, any cyberreport to the BoD should articulate key interests of the BoD, such as enterprise risk exposure, sources and nature of threats, risk imposed by the third-party vendors, residual risk and the appropriate spending level on cybersecurity.  The article demonstrates how to develop a hierarchical model to quantitatively communicate and report to the BoD the status of enterprise assets, threats, and key controls.

Because the BoD is responsible for overseeing the management of an enterprise, any cyberreport to the BoD should articulate key interests of the BoD, such as enterprise risk exposure, sources and nature of threats, risk imposed by the third-party vendors, residual risk and the appropriate spending level on cybersecurity. The article demonstrates how to develop a hierarchical model to quantitatively communicate and report to the BoD the status of enterprise assets, threats, and key controls.