Cybersecurity Is Just Too Serious For Boards to be So Clueless!

I just read Grading Global Boards of Directors on Cybersecurity, published by The Harvard Law School Forum on Corporate Governance and Financial Regulation, and I'm appalled by the findings laid out in the article and in the underlying Nasdaq/Tanium report THE ACCOUNTABILITY GAP: CYBERSECURITY & BUILDING A CULTURE OF RESPONSIBILITY

According to the report, the level of 'cyber literacy' was shockingly low: in the US, 59% of Directors, 77% of C-Suite, and 78% of CIOs 'indicated that they were cyber literate' (in some other parts of the world the numbers were far lower). As far as I could tell from reading the report cover to cover, these findings were obtained by asking rather than by testing knowledge. Do I even have to say 'Dunning-Kruger Effect' to make it clear how exaggerated the numbers might be?

Maybe I'm being too kind, but I can excuse 23% of the C-Suite for not feeling cyber literate. After all, they do interact regularly with the CIO and so rely on their 'IT guru' to guide them. And I don't know WHAT to say about the 22% of CIOs who don't feel cyber literate! (I know just what to say to their CEO's, though: 'organizations get the IT they settle for.')

It's the of 41% of Directors considering themselves 'cyber-illiterate' who are my focus here. Boards occupy a unique and vital position in corporate governance: they are proxies for the investors who entrusted their capital to a firm, and thus accountable for asking the right questions and understanding the answers to those questions. There's a great quote--attributed to Kris McConkey of PwC-- in the report:

"It’s knowing which questions to ask, but it’s also knowing what evidence looks like. It’s not even just being able to interpret the information, because a lot of that would be technical, but also being able to demand proof that somebody can stand by their answers."

These low levels of awareness and understanding by Directors is appalling in light of the ever-increasing pervasiveness of technology in products, processes, and throughout the operations of modern organizations.

While I agree with much of the Harvard Law School article, The authors state that what's needed to help Boards provide better cybersecurity governance is organizational adoption of the NIST cybersecurity framework. 

I disagree: not with the value of the framework, but with its effect on Board governance. The 'adoption' of a framework will do very little to actually increase the skills and interest levels of Board members. I've been CIO at organizations that 'adopted' the COBIT framework, among others. What I saw was real knowledge being acquired by the functional specialists (who already had a very high level of awareness and interest in the subject) and lots of internal 'marketing' of watered-down concepts by the training/compliance folks (that's not a dig at training and compliance folks. There are so many things about which employees need training and limited time/money budgets for serious training). Everyone took the required 15-minute video class, compliance was attested to, and life went on as before.

What's needed is the election of Digital Directors to Boards: seasoned business executives who have significant experience as CIOs (or CTOs and CDOs). The best 21st-century CIOs have spent years mastering technical issues (78% of them have, anyway) and almost as many years interacting with Boards, C-Suite peers, and even customers. These executives think in business terms first, and about technology as it relates to business--just like a good CFO thinks about business first and about FASB/IASB/SEC/IRS only in the business context. What Board members may not realize is that IT is one of two departments that see the entire 'order-to-cash' process/data flow from one side of the organization to the other, from organizational silo to organizational silo, and beyond (suppliers, bankers, partners, customers, etc.). This means a CIO has a good knowledge of just about every business process without having a special allegiance to any one organizational silo: that adds value as a Director over and above technical expertise.

Some Boards elect a technology-sector CEO or CFO and feel that provides the proper degree of cyber literacy. Maybe, maybe not. Knowing how to run a technology company is a valuable skill, but it's not the same as running an IT department and dealing head-on with disaster plans, security audits, technical debt, ERP conversions, and the myriad hands-on lessons that allow CIOs to interpret 'evidence' (for more about these other issues see my recent post Boards Should Ask IT About Overlooked Risks).

Boards are about 'noses in, fingers out.' A Board with a Digital Director able and willing to stick the right 'nose in' to technology matters will help drive a culture of awareness and accountability through an organization from the top down, where culture shifts should start.