How boardrooms are safeguarding digital assets

More than 90 percent of surveyed senior business leaders agree that strong technology governance contributes to improved business outcomes and increased agility, according to ISACA. Despite recognizing the link between governance and outcomes, a governance gap still exists, with 69 percent reporting that their leadership and board of director teams need to establish a clearer link between business and IT goals.

“The boardroom must become hyper-vigilant in ensuring a tight linkage between business goals and IT goals, fully leveraging business technology to improve business outcomes while diligently safeguarding the organization’s digital assets,” said Matt Loeb, CEO of ISACA. “The message from our research is clear: there is much work to do in information and technology governance. Committing to a boardroom with technology savvy and experience strongly represented provides the needed foundation for organizations to effectively and securely innovate through technology.”

Not all executive teams and boards walk the walk in matters of digital security. Data shows:

• Only 55 percent say their organization’s leadership team and board are “doing everything they can” to safeguard their organization’s digital assets and data.
• 21 percent don’t think their leadership team and board are “doing everything they can” to safeguard their organization’s digital assets and data, and 23 percent neither agree/disagree or don’t know.

As a part of overall governance, cyber security policies and defenses were cited as the number one corporate governance technological challenge and opportunity faced by senior leadership teams globally. Yet:

• Only 21 percent of senior leadership and boards are briefed on risk topics at every senior leadership meeting.
• Only one-third of organizations assess risk related to technology use on a monthly or more frequent basis.

Many leadership teams are prioritizing and increasing funding for cyber security and risk management programs:

• Almost half (48 percent) of leadership teams will prioritize funding expansion in cyber defense improvements, beating the number that intend to significantly expand funding for digital transformation (33 percent) and cloud (27 percent).
• Leadership teams also intend to fund increases in spending for security consultants (27 percent), upgrades to network perimeter defenses (25 percent), and cyber insurance (17 percent).
• Well over half (64 percent) of organizations have already increased spending on risk management in the past year versus last year, and 33 percent intend to increase spending in enterprise risk management programs over the next 12 months.

Leadership teams recognize that internal cyber threats are as real as external ones:

• 61 percent say the board or senior leadership team believes there is heightened risk from both external and internal risks.

Despite the widely recognized importance of cyber security, most organizations are not planning to increase funding for training over the next year:

• 35 percent of respondents intend to increase spending in data security training for employees.
• 15 percent of respondents intend to increase spending for cyber security training for board members.
• 21 percent of respondents intend to increase spending for employee privacy training.