How UK CISOs should prepare for a new era of growth

Authorities in the UK took a relatively early lead on cyber risk. The Government launched the National Cyber Security Centre in 2016, recognising that it needed to drive awareness and responsiveness. Campaigns, such as Cyber Essentials, provide a range of cybersecurity support for organisations of all shapes and sizes, while the Network and Information Systems (NIS) regulations introduced common levels of security for operators of essential services and digital service providers.

This national focus kept cyber risk at the top of the board agenda for many UK companies, ensuring it is widely regarded as a key business risk, assessed by risk committees and discussed in most corporate reports. In our findings, more than a third of UK respondents (34%) say that cybersecurity is a boardroom agenda item at least weekly or monthly in their firm. Globally, the figure is just 22%.

One result of this focus is that CISOs in the UK are, relatively speaking, well-resourced. Nearly 6 in 10 (59%) declare themselves happy with the funding they receive for cybersecurity, which is ahead of their counterparts in the US (56%), Canada (54%) and Australia (54%), as well as the global average (51%). At the same time, 46% of UK CISOs say that their board fully understands the value and needs of the cybersecurity team.

But a significant challenge remains. CISOs in the UK may have secured adequate budgets, but few have managed to shift the organisation’s perception of the role that cybersecurity plays, leaving them at risk of exclusion from the strategic conversation.

26% of US CISOs, by contrast, are brought into their organisation’s strategic conversations from the outset and have made this leap successfully. Just 1 in 10 UK CISOs have direct reporting lines to their organisation’s CEO, against 14% globally.

In the absence of a more strategic role, UK CISOs will struggle to take full advantage of their resources. Their work will remain reactive and tactical, rather than enabling the organisations to embrace security by design, or to future-proof their strategic investments. 

UK CISOs see supply chain cyber risk as the overall top challenge for their team. Nowhere else in the survey is the supply chain of such grave concern. Why is this? Much of the apprehension could be attributed to the sheer number of attacks that UK organisations have faced, that can be linked back to supply chain exposure.

An additional pressure point is the changing nature of the supply chain. Even before COVID-19 prompted businesses to review their resilience, companies in the UK were thinking about how the country’s departure from the European Union (EU) might affect their logistics. Brexit, bringing new rules on imports and exports to and from the EU, has forced businesses to rethink their networks — and take on new exposures to cyber risk.

In turn, less than half of UK CISOs (42%) are confident that their entire supply chain is secure in its ability to defend and recover against threat actors. It is not just immediate suppliers that worry them — 52% say third and fourth parties in their supply chain represent the greatest compliance risk to the organisation.

Clearly, CISOs in the UK recognise the scale of the issue. While 34% of CISOs globally say that fixing new vulnerabilities in the supply chain is a top priority in the wake of the pandemic, the figure rises to 40% in the UK.

One answer is to think about the organisational structure — including the governance — of cybersecurity. By implementing a centralised set of controls, from which all regulatory requirements pivot, security teams can ensure that they are responding to questions only once. With the right tracking and oversight, organisations can get to a point where responding to myriad compliance requests is owned by one person and comes from one set of controls.

Many CISOs would rather design cybersecurity structures to suit the critical risks that their organisations face, rather than simply to align with compliance requirements. A risk-based decision is better than a compliance-driven decision, but the key is to reduce the need to meet multiple different compliance requirements and to answer multiple questions.

Build stronger relationships across the business to address supply chain risk

Many UK CISOs worry about the strength of their relationships with other key business functions. While most report strong relationships with functions, such as finance, legal and risk, relations with marketing, product development and business lines, are not as resilient. Just 24% of the UK CISOs characterise their relationship with marketing as trusting and consultative, for example.

Strengthening these relationships will help CISOs transition into a more strategic role and could also be vital for supplier risk management. Moving closer to those operational areas of the business that initiate and maintain relationships with suppliers will be very valuable in this regard.

Train the board on how to interpret cyber risk — and cyber teams on telling the story

Some 57% of UK CISOs say that their boards sometimes make decisions on cybersecurity without having the technical understanding needed to fully understand the threat. This suggests there is more work to do to educate boards on what constitutes cyber risk and the potential response. Equally, the onus is on CISOs to provide information and analysis to boards in the most accessible, relevant and impactful ways. An overly technical approach to communication is unlikely to have cut-through, and CISOs may need help to articulate a narrative that really resonates with the board.