Corporate Governance and Ethics: Cybersecurity Policy of the Company

This report discusses the importance of cybersecurity in corporate governance and provides recommendations for developing a cybersecurity policy. It covers the background and requirements of cybersecurity, the meaning of cyber resilience, and the role and responsibility of the board in respect to the cybersecurity of the organization. The report also identifies methods of cybersecurity and provides recommendations for integrating cyber resilience protocols.

Running Head: Business Law 0
Corporate Governance and Ethics
1/22/2019
Student’s Name

Corporate Governance and Ethics
1
Contents
Report..............................................................................................................................................2
Cyber Security.................................................................................................................................3
Background 3
The requirement of Cyber Security 3
Cyber Resilience..............................................................................................................................4
Responsibility of Management........................................................................................................4
Methods of cybersecurity................................................................................................................5
Recommendations............................................................................................................................7
Conclusion.......................................................................................................................................9
References......................................................................................................................................11

Corporate Governance and Ethics
2
Report
To
Chairperson
Board of Directors
From: Jane White, Corporate Governance Consultant
Date: 22 January 2019
Subject: Cybersecurity policy of the company
In the world full of technology, every organization is diverting it is focused on the use of
technology. The reason behind the same is the infinite advantages that technology adds to the
overall value of the company. The use of the internet and other technological innovations makes
the working of the companies easy and smooth (Kumar, 2017). These techniques are more often
cost-effective and allow an organization to make an uninterrupted inflow and outflow of the
organizational information. Now, these days, for a business it is very easy and comfortable to
access the market. Almost every area of functioning such as sale, purchase, accounting, logistics
management demand specific attention of the management and in such a situation it is the
technology only which reduces the burden of the management. Nevertheless, another side of the
coin is also necessary to review. These technologies prove a danger for the business sometimes
when someone not uses the same effectively. Along with the advantages of the use of such
technologies and networks, certain liability also comes across. In such a situation, it becomes the

Corporate Governance and Ethics
3
responsibility of the managers to use such advancements in a logical way keeping the
confidentiality and integrity (Snedaker, 2007). The report presented hereby is focused on the
significance of the security feature with respect to the use of the network, internet, and other
technologies in the organization. Further, in conjunction to this, the best practices and methods
of data and cybersecurity will also be featured in the subjective report and at last the set of
recommendations will be provided to the board of directors of the company in order to develop
cybersecurity in the organization.
Cyber Security
Background
Cybersecurity can be understood as the protection of data, networks and computer system from
digital attacks (Cisco.com, 2018). In order to avoid the unauthorized access of terrorist,
cybercriminals, or any other outsider, cybersecurity protects the data and digital equipment. The
concept of cybersecurity is not just significant and crucial from the perspectives of individuals
but the same is crucial for business entities as well. Many harms are identified that can be there
at a place in the absence of proper cybersecurity. These harms and dangers include financial
frauds, production of child pornography, manipulation of data, taking over the control of the
system and so on (De Bruijn and Janssen, 2017).
The requirement of Cyber Security
In today’s time, organizations are used to manage almost every task with the help of machines
and technology such as the internet, networks, and computers. Failure in any one or more than
one can lead to great issues. All the business data can be stolen by just one click and businesses

Corporate Governance and Ethics
4
can lose their significant trade secrets (Bordony, 2018). Such issues not only make the financial
loss to the firms but also lead the issue of loss of goodwill. The public often feels fear to trust an
organization that has ever faced the issue of cybersecurity failure. They do not feel their data
secured with such entities. Many of the cases have happened there where terrorist hacked the
websites, data-based of the businesses with the purpose to use the same in criminal activities, and
hence one may think how dangerous the issue is and how significant is to find a solution.
Cyber Resilience
Cyber Resilience can be understood as the capability to prepare for, answer to, and recover from
cyber-attacks (Kott and Linkov, 2018). It is helpful for an organization as this protects the same
from cyber-attacks and ensures the capability of an entity to fight against such attacks. The
concept is new and has emerged during the past decades, as the traditional measure of
cybersecurity does not seem to be enough (Linkov and Kott, 2019). There are many methods by
using which an organization can increase its cyber resilience which is further stated in this report.
Responsibility of Management
In relation to cybersecurity, management has immense responsibility. An organization has data
related to all the stakeholders and in such a situation; it becomes the responsibility of the
management to keep the data secure (Morgan, 2018). The trust issues related to cyber security
exist at many levels and to removes all the issues, it is necessary to make a focus in this area.
This issues does not only exist within the origination but the outsider stakeholder also feels

Corporate Governance and Ethics
5
themselves as a part of cyber security gap. The issue can better understand by following
diagram:-
(Source:-Choi, Lung and Kaplan, 2017)
Cyber-attacks are the lead issues that the management of the organizations of almost every
industry is facing these days. This is the reason that the management is required to develop the
policies of these subjects in advance. Only preparation of the cybersecurity and resilience
protocols/policies are not enough but the management must ensure their enforcement and
effectiveness. It is the management of the company, which is responsible for good corporate
governance. Data privacy and security is another aspect of corporate governance as it develops
the trust of the public in an organization. Reviewing and considering the impacts of data breach
incidents, this would not be wrongful to state that cybersecurity is the prime responsibility of the
management (Shrobe, Shrier and Pentland, 2018).

Corporate Governance and Ethics
6
Methods of cybersecurity
As a part of corporate governance as well as corporate social responsibility, it is required to take
certain steps in the field of cybersecurity by the management. As mentioned above that some
methods to increase cyber resilience are there, the same are mentioned hereunder:-
1. The inclusion of cybersecurity in governance process:- This is a very first and necessary
step which demands the board of directors to include the topic of cybersecurity in their
governance process. The method says that the board of a company should consider the
topic of cybersecurity as one of their important agenda when it comes to the surety of
good corporate governance practices.
2. Strengthen cybersecurity protection for key assets:- Using the cybersecurity techniques
for all the assets can lead to an issue of budget. Therefore, this is to suggest that an entity
should divert the resources of cybersecurity on the major assets mainly. Here these
methods demand that the person responsible for corporate governance in the organization
should study the level of risk of cyber-attacks with respect to all the assets and divert the
focus and resources accordingly. For the major assets, the control should not limit typical
options and should go beyond the same using methods such as data loss prevention,
encryption, instruction detection, access right, and patching.
3. Development of security features: - An organization is required to build and develop the
security features for their IT systems. In house software and app, developers must have
certain tools that are useful to develop the strengthen system which is strongly protected
from unauthorized access and is less susceptible to hackers.
4. Use of active defenses:- This is the technique by using the same an organization can get
the signals of impending attacks. Some big companies use the technique of big data

Corporate Governance and Ethics
7
analytics to get the signals of unauthorized access to their networks or cyber-attacks
(Dhingra, Gryseels, Kaplan and Lung, 2018).
Recommendations
The above-mentioned points are few of the methods that can improve the cyber resilience in an
organization. Now moving the focus towards recommendations regarding the practices that
should be used to initiate a cyber-resilience, this is to mention that the management of an
organization is required to consider cyber-resilience as a management tool. At the board level
management can perform the following functions to initiate a cyber-resilience effectively:-
 Discussion and scope sharing: - This can be treated as the initial step. Before doing
anything in the subjective sector, it becomes the responsibility of the management to
identify the areas where cyber resilience is required. Afterward, managerial personals
are required to share their knowledge on this subject and they are advised to develop a
structure of cyber resilience. The management can also develop some committees to
divert the responsibilities. These responsibilities must be clear and properly
communicated.
 Communication: - Only development of cyber resilience policy is not enough but the
management must also properly communicate the same to respective people
(Shoemaker, Kohnke and Sigler, 2018). It means the cyber resilience officer and other
executives should be aware of the expectations of the board. This is an effective step,
which lead a positive impact on the in house governance.
 Defining role and responsibility: - While communicating the cyber resilience policy to
the organizational personnel, the board is also required to define the roles and

Corporate Governance and Ethics
8
responsibilities of them. It is the step where the board held the people accountable for
their jobs. The employees must have sufficient knowledge, experience and enough
authority with respect to their works.
 Surety of resources: - Management of the company should check whether the cyber
resilience officer and other employees who have the responsibility of data and network
security have the proper resources and assistance to complete their jobs (Veltsos, 2017).
These resources may be helpful to make, implement, assess, and polish cyber resilience
efforts across the entity.
 Regular updates: - At the board level, it is the responsibility of the management of the
company to keep itself update about the current threats to the digital system. Further, the
management must be aware of various kinds of data breaches that happen in the related
business environment. In conjunction to this, the board of the organization is also
advised to keep itself aware of the latest technologies that business competitors are
using these days in against of cyber-attacks.
 Alignment with the overall governance: - For an effective cyber resilience policy, it is to
ensure that the same must not contradictory with the overall governance structure of the
organization. It means the board of the company must ensure that the plans, policies,
strategies, and rules are in line with the overall governance of the organization.
 Collaboration and Training: - To ensure continued corporate survival and improved
business performance, training is a must. In order to develop the staff education and
awareness, the board should organize training and such training must be monitored and
managed against success criteria. Through Continuous development, staff became a

Corporate Governance and Ethics
9
more aware and effective defense in against of malicious cyber activities (Asic.gov.au,
2018)
 Review: - After the implementation of cyber resilience policy across the organization,
the board should timely review the same in order to check the success or failure. This is
an important activity to do which let the board of directors informed about deficiencies
in the current system. Random staff testing, continuous monitoring systems are some of
the tools using which the board can review the effectiveness of cyber resistance policy
(Graham, Olson and Howard, 2016).
 Response and recovery planning: - If in the review process, the board of the company
comes to know about the loopholes or any failures, then it becomes the responsibility of
the same to fix it. Until the deficiencies would be there, a cyber-resilience cannot seem
to be there and therefore it is a significant step to be done (Estuate.com, 2018)
Conclusion
This is to conclude that in the current century, cybersecurity becomes as much important as the
same cannot be ignored. Not just the individuals but also the organizations and their whole
systems are way much dependent on the technologies and therefore cybersecurity becoming
significant day by day. The report hereby presented prescribed the background and requirements
of cybersecurity in the organization. In addition to this, the same has also presented the meaning
of cyber resilience and need of the same. The report identified the role and responsibility of the
board in respect to the cybersecurity of the organization and the same have found related to the
corporate governance., This is to state that many of the methods have been given in the
subjective report using which the organization can protect the database and networks secure. In

Corporate Governance and Ethics
10
general, all the mentioned tools are useful but the most useful one is active defense. This defense
identifies the cyber-attacks in advance and makes the cyber resilience officer enable to prevent
the same. Further, as asked by the board of directors, the report majorly focused on the ways and
techniques, which are useful, while integrating the cyber resilience protocols. All the steps given
are important. The focus mainly made on the practices of the board of directors and management
of the organization. It means all the given activities such as discussion, communication,
resources allocation, and review need to be done at the board level. The most important point,
which again needs to be a highlight, is the alignment of cybersecurity protocols and policies with
the overall governance as this should be part of the company’s governance and should not
overlap the same.

Corporate Governance and Ethics
11
References
Asic.gov.au. (2018) Cyber resilience good practices. [online] Available from:
https://asic.gov.au/regulatory-resources/digital-transformation/cyber-resilience/cyber-resilience-
good-practices/ [Accessed on 23/01/2019]
Bordony, S. (2018) The importance of maintaining cyber security in your business. [online]
Available from: https://www.itproportal.com/features/the-importance-of-maintaining-cyber-
security-in-your-business/ [Accessed on 23/01/2019]
Choi,J., Lung, H,. and Kaplan, J. (2017) A framework for improving cybersecurity discussions
within organizations. [online] Available from:
https://www.mckinsey.com/business-functions/digital-mckinsey/our-insights/a-framework-for-
improving-cybersecurity-discussions-within-organizations [Accessed on 23/01/2019]
Cisco.com. (2018) What Is Cybersecurity? [online] Available from:
https://www.cisco.com/c/en/us/products/security/what-is-cybersecurity.html [Accessed on
23/01/2019]
De Bruijn, H. and Janssen, M. (2017). Building Cybersecurity Awareness: The need for
evidence-based framing strategies. Government Information Quarterly, 34(1), pp.1-7.
Dhingra, A., Gryseels, M., Kaplan, J., and Lung, H. (2018) Digital resilience: Seven practices in
cybersecurity. [online] Available from: https://www.mckinsey.com/business-functions/digital-
mckinsey/our-insights/digital-blog/digital-resilience-seven-practices-in-cybersecurity [Accessed
on 23/01/2019]

Corporate Governance and Ethics
12
Estuate.com. (2018) How to build Cyber Resilience in your enterprise?.
https://www.estuate.com/company/blog/how-build-cyber-resilience-your-enterprise
Graham, J., Olson, R. and Howard, R. (2016) Cyber security essentials. New York: Auerbach
Publications.
Kott, A., and Linkov, I. (2018) Cyber Resilience of Systems and Networks. Switzerland:
Springer.
Kumar, V. (2017) Top 25 powerful advantages of internet for business. [online] Available
from:http://www.klientsolutech.com/top-25-powerful-advantages-of-internet-for-business/
[Accessed on 23/01/2019]
Linkov, I. and Kott, A., 2019. Fundamental Concepts of Cyber Resilience: Introduction and
Overview. In Cyber Resilience of Systems and Networks (pp. 1-25). Springer, Cham.
Morgan, J. (2018) Board and management responsibilities for information security. [online]
Available from: https://www.cio.com/article/3252783/governance/board-and-management-
responsibilities-for-information-security.html [Accessed on 23/01/2019]
Shoemaker, D., Kohnke, A., and Sigler, K.(2018) How to Build a Cyber-Resilient Organization.
NW: CRC Press.

Corporate Governance and Ethics
13
Shrobe, H., Shrier, D. L. and Pentland, A. eds., (2018) New Solutions for Cybersecurity.
Cambridge: MIT Press.
Snedaker, S. (2007). Business continuity & disaster recovery for IT professionals. Burlington,
MA: Syngress.
Veltsos, C. (2017) Cyber Resilience Tools and Principles for Boards of Directors. [online]
Available from: https://securityintelligence.com/cyber-resilience-tools-and-principles-for-
boards-of-directors/ [Accessed on 23/01/2019]