What is cyber risk appetite, and why should the board set it?
It is the amount and kind of cyber risk the board is willing to accept in order to run the business, written down so others can act on it. It turns into concrete statements, for example: production may stop for no more than one day; customer data must never leave the EU; we accept that a laptop is occasionally lost, but never an unencrypted one. Such statements let IT and suppliers make decisions without asking the board each time, and they show where money is needed: if a full restore takes five days and the limit is one, there is a gap to close. Keep the statement short and review it yearly. It is a management decision that no tool can make. NetSenX helps measure one side of it: how quickly unusual network activity is seen.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Should the board get cyber security reports from IT or from outside?
- How do we know our IT provider is doing a good job on security?
- Who should sign off answers to customer security questionnaires?
- How do we explain a cyber incident to customers and the press?
- Should we tell employees about a cyber incident?