Not enough CISOs and business leaders cooperate on a cybersecurity plan and budget

With the proliferation of more and more sensitive data, expanding connectivity, and the adoption of automated processes, new research from Accenture reveals that C-suite and IT decision makers need to embrace a different approach to cybersecurity to effectively protect against future cyber risks.

While most companies have a CISO or assigned cybersecurity to a C-suite executive, such as a CIO, often, these leaders have limited influence on cybersecurity strategy outside their departments. Additionally, nearly half of CISOs acknowledge that their responsibilities for securing the organization are growing faster than their ability to address security issues.

In the study “Securing the Future Enterprise Today – 2018,” 73 percent of the more than 1,400 C-level executives polled agreed that cybersecurity staff and activities need to be dispersed throughout all parts of the organization, but cybersecurity remains centralized in 74 percent of companies.

Moreover, there is little indication that C-suite executives expect to shift more responsibility for cybersecurity to business units. For example, 25 percent of non-CISO executives say business unit leaders are accountable for cybersecurity today and a similar number believe business unit leaders should be responsible in the future.

“There is no doubt that organizations are taking cybersecurity more seriously, however, there is still much work to be done. Cybersecurity strategy needs to be led by the board, executed by the C-Suite and owned at the front lines of the organization. Further, it must be infused across all aspects of a company’s processes and systems, and built into the daily work activities of employees,” said Omar Abbosh, Accenture’s chief strategy officer. “To be able to grow safely, companies can establish sustained cyber resilience through a continual, proactive focus on cyber risk management at all levels.”

Better alignment needed on strategy and protection practices

The study exposed a disparity between what C-suite executives say are the emerging areas of concern and the cybersecurity strategies employed for protection. For example, companies are still doing little to spread security knowledge among employees and very few CISOs have the authority to influence business units across their organizations.

• Only half of respondents said all employees receive cybersecurity training upon joining the organization and have regular awareness training throughout employment.
• Surprisingly, only 40 percent of CISOs said establishing or expanding an insider threat program is a high priority.
• Just 40 percent of CISOs said they always confer with business-unit leaders to understand the business before proposing a security approach.

Top cyber risks: New technologies and data sharing

C-suite executives view several types of new technologies and tools as raising cyber risk for their companies and they’re highly concerned about the potential dangers of sharing data with third parties.

• Internet of Things technology topped the list with 77 percent of respondents saying that it will increase cyber risk moderately or significantly.
• Seventy-four percent of respondents said cloud services will raise cyber risk, but only 44 percent said that cloud technology is protected by their cybersecurity strategy.
• More than seventy percent of respondents expect sharing data with strategic partners and third parties will raise risk, yet only 39 percent said that the data exchanged is adequately protected by their cybersecurity strategy.