Summary

Managing cyber risk is difficult for almost every firm and its board of directors. Cybersecurity is a sophisticated technological field in which new threats emerge almost weekly. Despite the fact that most board members are not cyber professionals, boards of directors have a duty to recognize and monitor this risk. This requires active participation with leadership and access to experts, as well as comprehensive information and reporting from an organization’s upper management.

Specifically, boards of directors want to know whether management is focusing on the appropriate cyber risks, how management manages those risks, and whether the efforts are sufficient. This begins with gaining an overview of a company’s cyber-risk management program as well as its cyber-risk tolerance.

Furthermore, some boards have determined that cybersecurity is a risk that requires the oversight of the whole board, rather than a specific committee. Whatever the case, if supervision...