According to a 2022 Verizon report, 43 percent of all data breaches reported worldwide targeted small and medium-sized businesses – with numerous businesses reporting at least eight hours of downtime after a severe cybersecurity incident. Little surprise, then, that demand for cyber liability insurance has surged in recent years. Businesses – especially small ones, with fewer financial resources – want to be made whole after a disruption.

Naming a company is one of the most important decisions a business ever makes. It’s the first thing potential customers will see, and it’s what they’ll use to remember you. A good company name helps establish credibility and image.

The security industry spent decades propagating the myth that risk is bad, and you must eliminate it — but this truth is… Your biggest risk could be the way you view it. You see, there are various “lenses” through which to view risk: rose-colored, blinders, magnifying and crystal clear. After presenting this concept at an ISACA-sponsored webinar, I received many questions and comments about putting this into practice.

Chief information security officers (CISOs) have both internal- and external-facing roles. Externally, they must constantly scan the horizon for potential threats. Internally, they must implement, communicate, and champion best practices for security at their enterprises. In a time of sprawling global supply chains and growing automation, the role of the CISO is more complex than ever. To carry out this role effectively, CISOs must learn the importance of trust management.

When you think about third-party risk management, what comes to mind? Are you concerned with measuring the effectiveness of your program? Do you know which third-party providers to focus your risk management efforts on? How are you evaluating your providers during the due diligence process?

Companies around the world and across industries face greater cyber threats than ever before. Cybersecurity incidents are becoming ever more frequent, and the costs associated with those attacks have marched upward too. As the risks grow, companies have strengthened their capabilities, both in prevention and incident response. Still, no company can guarantee that it will never be hacked, so companies must have cyber insurance in place in case the worst happens.

Internal controls can serve two purposes: to protect a business from accounting fraud, asset loss, or similar financial reporting failures; and to assure that the business meets its regulatory compliance obligations. An audit evaluates the accuracy of a company’s financial statements and the effectiveness of its internal control system to identify control weaknesses. In addition, audits typically include some form of substantive testing, which tests for risks of material misstatements and errors.

These four words are all too familiar to most CISOs and Risk Managers. In fact, nearly 70% of cybersecurity practitioners and decision-makers feel that their organization doesn’t have enough security staff to be effective, found a recent Cybersecurity Workforce Study.1 Infosec and cyber risk management teams are usually small, stretched thin and overwhelmed with work.

Legal authorities and the general public typically hold organizations accountable for any harm caused during their daily operations. The expectation is that leaders of those organizations have considered the potential harms that might happen, and implemented reasonable precautions to reduce or eliminate the risks. This is known as the “DoCRA standard.”

In today’s interconnected world, it’s easy for organizational leaders to see a security incident on the news and question if they could be next. Security is often top of mind but rarely a strategic priority, leaving many CISOs struggling to communicate how to reduce risk to the board. And the latest risk management trends could present new challenges for security leaders. How can you overcome them?

Today we are going to keep looking at artificial intelligence and how corporations can get ahead of the risks thereof. Our previous post on AI was primarily a list of potential risks that could run rings around your company if you’re not careful; so what steps can the board and senior executives take to prevent all that? Well, first things first. AI is a new technology.

Banking is a heavily regulated business sector, with stiff requirements to manage liquidity, financial reporting, cybersecurity, business continuity, and more. Managing that compliance burden is challenging, but failing to comply with those obligations can result in monetary penalties, operating restrictions, bad publicity, and even lawsuits. Given all that, banks need to conduct regular compliance risk assessments to identify, evaluate, and mitigate emerging risks.

In today’s world organizations rely on computer systems and data for pretty much everything, including mission-critical processes and interactions with customers. And given the relentless increase in cybersecurity threats, this means that organizations’ need to protect themselves and their customer data from such threats is paramount. The average cost of a single data breach in the United States is now $9.44 million.

Companies and their many stakeholder groups depend on accurate information. Whether you’re a manager, investor, board director, or employee, it’s crucial to have an accurate picture of what is happening in a company. Publicly traded companies provide this picture through financial data, collected and shared through formal, published financial reports.