September 2022 / 10 Min Read

Navigating Cybersecurity Risks & Disclosure Pressures: Good Governance is Key

With cybersecurity thrust to the forefront of boardroom discussions today, transparent communication about its governance is now crucial.

Key Takeaways

Newly proposed regulatory rules in the US, Europe and India set more stringent cybersecurity risk management measures and reporting for all public companies.
The growing concerns around cyber vulnerabilities have led to third-party rating services attempting to quantify cyber risk into a consolidated score.
It is important for companies to navigate cyber governance and cybersecurity disclosure pressures without compromising business security.

With cybersecurity thrust to the forefront of boardroom discussions today, transparent communication about its governance is now crucial.

The rise of cyberattacks amplified by geopolitical conditions, newly proposed regulatory rules, and emerging third-party cyber risk scores, have thrust cybersecurity to the forefront of boardroom discussions.

“There’s unprecedented pressure on companies to report information about their cybersecurity risk management and governance practices, policies, and procedures,” said Heidi Wachs, Managing Director, Cyber Solutions, Aon.

While transparent communication about cybersecurity governance is crucial today, businesses must balance that with protecting sensitive and confidential information to avoid unnecessary attention from threat actors.

New SEC Cybersecurity Rules

Cyber disclosure pressures are mounting on companies worldwide. On 9 March 2022, the US Securities and Exchange Commission (SEC) published proposed rules that require all public companies to report material cybersecurity incidents within four business days. Companies would also be required to make periodic disclosures regarding their cybersecurity risk management, strategy, and governance.

“The proposed Item 106(b) of Regulation S-K would require registrants to disclose their policies and procedures to identify and manage cybersecurity risks and threats,” Anna Barrera, Director, Corporate Governance and ESG Advisory, Aon, explains.

SEC's proposed Item 106^(b) of Regulation S-K

A public company must disclose whether it:

Has a risk assessment program (if applicable), and if so, provide a description

Engages assessors, consultants, auditors, or other third parties in connection with any cybersecurity risk assessment program

Has policies and procedures to oversee and identify the cybersecurity risks associated with the use of any third-party service provider

Undertakes activities to prevent, detect, and minimize the effects of a cybersecurity incident

Has business continuity, contingency, and recovery plans in the event of a cybersecurity incident

Considers cybersecurity risks as part of the registrant's business strategy, financial planning, and capital allocation and if so, how

More Like This

Article
Cyber Attacks/Data Breach

Article
Disclosure of Cyber Risks May Get More Detailed Following a Change in ESG Ratings

Article
Top Ten: Cyber Governance For Boards Of Directors

Europe too is stepping up its cybersecurity standards. Replacing the current Directive on Security of Network and Information Systems (NIS), the new NIS2 directive sets more stringent cybersecurity risk management measures and reporting requirements and sanctions for sectors such as energy, transport, health and digital infrastructure.

A new cyber notification standard was also issued by India’s Ministry of Electronics and IT (MeitY) on 28 April aiming to improve overall cybersecurity. According to the directive, 27 June 2022 onwards, it is mandatory for all companies in India, including government and private organizations, to report cyber incidents to the Indian Computer Emergency Response Team (CERT-In) within 6 hours of detection.

“Legislative movements towards stricter cybersecurity worldwide makes it clear that regulators view cyber risk as material to investors,” says Barrera. “Good governance will be key to help companies navigate increasing cyber disclosure pressures, achieve regulatory compliance and enhance investor relations.”

As companies navigate disclosure requirements, they will need to balance the risk of divulging vulnerable information on a firm’s cyber risk mitigation strategies.

“To the extent possible, acknowledging the existence of applicable policies, programs, and plans, without including details about their content, can protect your company’s sensitive cybersecurity procedures,” Barrera adds.

And, of course, the growth of voluntary carbon markets fuels development of nature-based solutions and raises awareness of their benefits.

Good governance will be key to help companies navigate increasing cyber disclosure pressures, achieve regulatory compliance and enhance investor relations.”

Anna Barrera
Director, Corporate Governance and ESG Advisory, Aon

Institutional Shareholder Services (ISS) Launches Cyber Risk Score

According to Aon’s 2021 Global Risk Management Survey, participants around the globe rated the risk of cyberattacks/data breach as the number one threat facing companies today. The growing concerns around cyber vulnerabilities have led to third-party rating services attempting to quantify cyber risk into a consolidated score.

The risk of cyberattacks/data breaches is a top threat facing businesses worldwide today

1 North America

2 Middle East and Africa

2 APAC

4 Europe

9 Latin America

Source: Aon's 2021 Global Risk Management Survey

The ISS also added scored cyber risk factors to its Governance QualityScore ratings. Taking the attention to cyber risk a step further, the ISS launched a quantifiable 3-digit Cyber Risk Score based on policies, information security standards, and cyber hygiene, and reflects the likelihood of a future cybersecurity incident

Alongside its Governance QualityScore, the Cyber Risk Score will be included for informational purposes in ISS’ proxy research reports, which also contain voting recommendations to investors for annual shareholder meetings.

“While such ratings do not impact ISS’ actual voting recommendations, they provide investors assurance that boards are actively managing their cyber risk exposure,” Barrera explains. “Therefore, their visibility within the reports makes them a frequent topic of conversation within the boardroom.”

ISS ESG Governance Quality Score

What?

Data-driven scoring and screening solution

Why?

To enable quality reviews of corporate governance across four key areas:

Board Structure
Compensation
Shareholder Rights
Audit & Risk Oversight

“As with QualityScore, ISS will permit companies to use their data verification process to dispute specific factors that go into the Cyber Score,” says Barrera. “However, there is no guarantee that ISS will agree to the changes.”

“It is also important to note that ISS will only work off public information, so any requested change will have to be verifiable in public disclosures,” she advises. The ISS Cyber Risk Score solution follows the lead of Glass Lewis, a leading provider of independent global governance solutions that announced a partnership with BitSight, a cybersecurity ratings provider in September 2021. According to their agreement, BitSight rating, data, and insights are now included in Glass Lewis’ Proxy Paper research reports.

“When deciding whether to improve cyber ratings through additional disclosures, companies need to weigh potential risks of over-disclosing on sensitive topics,” Barrera advises. “This caution holds true in the realization that ISS ratings (Governance QualityScore, Environmental & Social QualityScore, and Cyber Risk Score), and other third-party ratings, do not directly impact actual proxy voting recommendations or outcomes.”

“Companies must remain aware of their external ratings and manage communications around relative scores for investors and other stakeholders as needed,” she adds.

Top Tips

1 Meeting emerging regulatory requirements

2 Ensure a business-appropriate cybersecurity strategy

3 Evaluate the tradeoffs between using additional disclosures to improve third-party ratings and potentially attracting more threat actors

Next Steps

When determining what information to disclose, companies should first focus on demonstrating a mature approach to cyber governance at the Board level. “Sharing tactical cybersecurity plans may divulge information threat actors can leverage,” David Collier, Senior Vice President, Cyber Solutions, Aon, explains. “But sharing information around cyber governance demonstrates an enterprise-wide commitment to this material issue.”

When deciding whether to improve cyber ratings through additional disclosures, companies need to weigh potential risks of over-disclosing on sensitive topics.”

Anna Barrera
Director, Corporate Governance and ESG Advisory, Aon

Sample disclosures on board and executive management oversight of cybersecurity might include acknowledgment of the following governance practices, if applicable:

Formal threat assessment
Recognized standard for the management and oversight of cybersecurity
Security roadmap and metric-driven dashboard
Chief Information Security Officer or equivalent role
Cross-functional cyber committee
Third-party penetration testing
Vendor cybersecurity policy and audit
Cybersecurity insurance policy

“In disclosing information, companies should avoid sharing sensitive details, such as specific tools, software, or applications used in the environment, findings from a threat assessment, vulnerabilities, remediation strategies, cybersecurity budget, and dashboard metrics,” Wachs advises.

Aon’s Cyber Solutions Group and Aon’s Corporate Governance & ESG Solutions Practice work with clients to implement appropriate cyber governance practices, develop robust cybersecurity policies and procedures, and navigate disclosure pressures without compromising company security.

For more information about how we work with C-suite and boards on cyber risks and disclosures, please contact the authors or write to humancapital@aon.com.

General Disclaimer
The information contained herein and the statements expressed are of a general nature and are not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information and use sources we consider reliable, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act on such information without appropriate professional advice after a thorough examination of the particular situation.

Terms of Use
The contents herein may not be reproduced, reused, reprinted or redistributed without the expressed written consent of Aon, unless otherwise authorized by Aon. To use information contained herein, please write to our team.