Cyber Defense eMagazine March Edition for 2022

Make clear the opportunity cost
There is, of course, a cost to cyber security systems, but the cost to not having them is far larger. The
average cost of an attack has been rising rapidly and now stands at $3.9 million, according to the annual
Cost of a Data Breach Report by IBM and the Ponemon Institute, although this rises to $8.64 million in
the US. This includes costs of OT systems and hardware, disruptions to critical activity resulting in down
time and business lost, and fines. When put in this context, the investment in cyber security will seem
minimal. Businesses that rely on insurance as mitigation may feel that they are covering the financial
cost, but this does not take into account the cost of reputational damage, which can far exceed any
monetary loss. Further, the insurance market is taking a tougher stance due to the rising frequency and
scale of cyber-attacks. This makes it a multi-faceted challenge for finance leaders.
Think about long term sustainability
Cyber-resilience is about ensuring the continued success of an organization. Business continuity,
reputation and finance are all at stake, but also the potential for injury and even loss of life. Imagine how
much money would be lost if you were unable to service clients, and the reputational damage of a splash
across the headlines. To continually win new business you need to be able to show you are diligent and
trustworthy, and cyber security plays a big role in this. Data security is increasingly important, and
customers will not want to do business with you if their own information is seen to be at risk. Similarly,
vendors will harbor concerns about stability and ultimately shareholders will become worried about
performance.
See cybersecurity not as an IT overhead but an OT asset
Cyber security is not just a tick box or policy adherence exercise, but brings huge value. It’s about more
than systems and software of IT – it’s essential for full and essential OT. The CFO’s remit spans the
entire business, meaning they are perfectly positioned to support cyber security efforts spanning the
entire estate. They are able to look at the technology and systems and what investment in them can bring
the business from a strategic standpoint.
Improve the risk management framework
The CFO’s job is to finance things that are business critical. If the Chief Information Officer (CIO), Chief
Information Security Officer (CISO), Senior Management Team (SMT) make cybersecurity part of
everyone’s role, from team members to those at the top of the organization, it ensures it is ingrained in
policy and procedure. By having this shared visibility and responsibility, it will be clearer as to why it needs
financing, not just as a cost centre, but an enabler. Cyber security is about protecting the assets that are
of value to your company, and so should be embedded in everything that you do. Effective governance
is essential to business success.
Cyber Defense eMagazine – March 2022 Edition 26
Copyright © 2022, Cyber Defense Magazine. All rights reserved worldwide.