Editor's note: Steve Vintz (pictured), CFO at Tenable — an exposure management company — shared with his professional peers what they can do when it comes to mitigating cyber risk.
FutureCFO: What's the role of CFOs in mitigating cyber risk now? How can CFOs work with CIOs or CSOs to guard their organisations?
Steve Vintz (SV): In today's landscape, cybersecurity has transitioned from being viewed solely as a business expense to a crucial driver of business success, and crucial for mitigating risks.
Organisations are slowly acknowledging that cybersecurity extends beyond the realm of IT and can have significant financial consequences.
As a result, CFOs are entrusted with comprehending and managing their organisations’ cyber risk, along with the corresponding financial implications.
This transformation signifies that CFOs are no longer passive observers or mere guardians of financial matters but have become essential collaborators in safeguarding the organization's digital security.
Collaborating closely with the CIO or CSO, CFOs have the opportunity to align business objectives with cybersecurity strategies. This entails assisting in identifying, prioritising, and financing cybersecurity initiatives.
CFOs play a pivotal role in risk management by evaluating and quantifying cyber risk in financial terms, thus justifying the need for investments in cybersecurity.
By taking a proactive stance within the cybersecurity team, CFOs can make well-informed decisions that directly minimise revenue losses and mitigate risks.
Furthermore, CFOs can support CIOs and CSOs by implementing a comprehensive cybersecurity risk management framework.
This includes integrating cybersecurity into the organisation's overall risk management strategy, measuring and reporting risks, and ensuring the implementation of appropriate controls and protocols are implemented.
Collaborating closely with the CIO or CSO, CFOs have the opportunity to align business objectives with cybersecurity strategies.
FutureCFO: What are the potential financial and business impacts of cyber incidents that CFOs should work to deter?
SV: The potential consequences of cyber incidents on an organisation's financial health and reputation are extensive and can be highly damaging.
Incidents incur direct costs such as incident response, recovery and regulatory penalties. Indirect costs include reputational harm, erosion of customer trust and potential legal liabilities.
Moreover, cyber incidents can disrupt operations, leading to reduced productivity and revenue loss. The loss of intellectual property resulting from data breaches can have long-lasting strategic implications.
Furthermore, the tightening of global data privacy laws increases the risk of lawsuits following a breach. Publicly traded companies may experience significant stock price declines due to cybersecurity incidents.
These ramifications emphasise that cyber risk is a business risk.
As a result, CFOs need to collaborate closely with their teams to proactively invest in cybersecurity infrastructure, resources, and awareness training to mitigate the occurrence of such incidents.
FutureCFO: How can CFOs quantify cyber risk?
SV: Quantifying cyber risk requires CFOs to understand the organization's attack surface in terms of "where are we exposed?", "where should we prioritise based on risk?", and "how are we reducing our exposure over time?"
Collaboration with CISOs is crucial to comprehend the financial implications of security risk and determine necessary technology investments.
While CFOs may not possess technical expertise, grasping the importance and impact of investments in risk reduction is vital.
By working with risk management and cybersecurity teams, CFOs can identify critical assets and associated threats, such as customer data, intellectual property and operational systems.
Assessing the potential consequences of breaches, including financial losses, operational disruptions, and reputational harm can be done using historical data from previous incidents within the organisation or the industry.
FutureCFO: How can CFOs make strategic investments in cybersecurity while dealing with budgetary constraints?
SV: CFOs should prioritise cybersecurity investments based on risk, considering the potential impact and likelihood of threats.
Balancing preventive measures and response capabilities within budget constraints is crucial for optimising spend without compromising security.
Collaboration with the CISO is necessary to align cost, performance and risk reduction objectives with business needs.
A holistic understanding of the attack surface and the security status of critical assets is essential. Metrics and benchmarking processes tied to business performance and process improvement should be sought from the CISO.
Compliance should not be the sole focus, as meeting regulatory standards does not guarantee appropriate security practices or address financial risk.
Instead, organisations should understand critical assets, identify vulnerabilities and create a security programme to address concerns.
Strategic investments in cybersecurity must align with the overall business strategy and objectives.
Consolidating tools for efficiency and reducing tool sprawl ensures that every dollar spent contributes to reducing and mitigating cyber risk.
Adopting a platform approach for unified security functions enhances cost and operational efficiencies.
