Best Practices for Cyber Resilience in Corporate Governance

This paper provides examples of best practices and a clear set of recommendations on how the company should initiate a cyber resilience policy at the corporate board level. It addresses the challenges of cybersecurity and cyber resilience for organizations and the responsibility of controlling cyber risks that rely on the board and top managing business directors. The paper also discusses the importance of safeguarding value in the business and the need for boards to illustrate to the public and investors that cyber risks can be managed.

Corporate Governance 1
CORPORATE GOVERNANCE
By Name
Course
Instructor
Institution
Location
Date

Corporate Governance 2
EXECUTIVE SUMMARY
Cybersecurity and cyber resilience are serious challenges for many organizations
currently. Corporate governance consultants increasingly recognize that the philosophical
reputation as well as the existential nature of these perils means that the responsibility of
controlling the cybercrimes relies on the board and the top managing business directors.
Several organizations, however, do not feel that they are well prepared with adequate tools to
enable them to accomplish the cyber risks effectively. Because of the cyber risks like cyber
security and cyber resilience, almost every organization has become a steward of information
which they have control over and every organization contributes to the cyber resilience of not
only the immediate clients but also suppliers and partners. This paper will address the providing
examples of best practice and a clear set of recommendations on how the company should
initiate a cyber resilience policy at the corporate board level.

Corporate Governance 3
Table of Contents
EXECUTIVE SUMMARY.......................................................................................................................2
INTRODUCTION.....................................................................................................................................4
DEFINITION.............................................................................................................................................5
EXAMPLES...............................................................................................................................................6
i. Keeping the systems up-to-date......................................................................................................6
ii. Back up the data..............................................................................................................................6
iii. Educate and train............................................................................................................................7
iv. Get regular risk assessments...........................................................................................................7
v. Establish a strong password............................................................................................................7
vi. Put up a strong firewall....................................................................................................................8
vii. Installing the antivirus.................................................................................................................8
viii. Secure the organization laptops..................................................................................................8
ix. Encrypt data....................................................................................................................................9
RECOMMENDATIONS..........................................................................................................................9
i. Double down or triple down on the basics.......................................................................................9
ii. Focus on people and culture..........................................................................................................10
iii. Establish a cybersecurity risk policy with clear risk appetite..........................................................10
iv. Ask for an effective risk report with qualitative evaluation and quantitative................................10

Corporate Governance 4
v. Give a credible challenge and oversight of the cybersecurity program..........................................10
CONCLUSION........................................................................................................................................11
BIBLIOGRAPHY...................................................................................................................................12

Corporate Governance 5
INTRODUCTION
Other than having cybersecurity and information security on the plan for each board
assembly, the board of executives moreover has to be utilizing the leading practices for cyber-
protection (Rezek, 2015). Board individuals ought to run their possess hazard evaluation on the
gadgets that they are utilizing and guarantee that their communication strategies don't expose
board materials to pernicious assaults. Email ought to be avoided and supplanted by a secure
communications device that can anticipate board materials from being sent to an outside party by
the blunder.
Moreover, the board of directors must be looking for the correct product to ensure that
they are utilizing as little technology as possible in the boardrooms of the business (Sullivant,
2016). This is present in the diligent governance cloud, this is a solution of an integrated
enterprise governance management which makes the organization to realize first-class corporate
governance as well as digitizing the several actions and duties of the board of executives. With
the expansion of the organization more complex cyber security and cyber resilience need to be
put into practice to ensure that the business is more secure hence more performance. The
governance Cloud enable the board of directors to archive the demands in the organization
boardrooms as well as beyond with the capability to select the goods they want, this will help
them to do their best and work within the organization allocated budgets (McLaughlin, 2015).
Cybersecurity features high on the agenda of corporate governors in every sector, with
business, individuals and governments quickly taking benefit of quicker, inexpensive digital
skills to provide an unparalleled array of economic and social benefits. The procedure of
connecting and digitizing, nevertheless, introduces a range of new problems. Essentially, a
perfect cyber risk governance deals with safeguarding value in the business. Boards will

Corporate Governance 6
progressively need to illustrate to the public and investors that cyber risks can be managed, and
this is not only from a technical perspective but also from a financial and governance perspective
(Cascarino, 2012). External shareholders will progressively seek a guarantee that organizations
have efficacy cyber risk governance in position. It is now a certainty for dire infrastructures in
the Network Information Security Directive. This introduces new reporting necessities for
security occurrences and supports "a culture of risk management, comprising risk assessment as
well as the implementation of security procedures suitable to the faced risks”
DEFINITION
Corporate governance: This is a system where the organizations are controlled and directed.
In such cases, the board are accountable for the governance of the organizations. The stakeholder
´s duty in governance is to assign the board to gratify themselves that a suitable governance
structure is in position. Corporate governance hence deals with what the board of the company.
Cybersecurity: This includes technologies, processes and controls which are designed to guard
systems, information and networks from cyber assaults (Kamar, 2017). Efficacy cyber security
help to reduce the perils of the cyber-attacks and safeguard the individuals and the organizations
from unauthorized system exploitation and technologies exploitations.
Cyber resilience: This is a bigger approach which entails both the business continuity
management and the cybersecurity with the main objective of defending the business against the
potential cyber as well as ensuring that the organization survives the cyber-attacks which will for
sure jeopardize with the normal operation of the business which will in turn results to failure of
the business.

Corporate Governance 7
EXAMPLES
In the process of safeguarding the business against the unauthorized cyber attackers, there are
some practices which the management of the business need to keenly check to help promote the
full security and keep these criminals away. This will help the business to protect their data and
information as secrete to them as possible. Some of these examples of best practice of
safeguarding the business against the cybercriminals are as below;
i. Keeping the systems up-to-date
System updates in the business organization are very important because there are several reasons for
updating these systems. (ISACA, 2013). This can be done when where an individual was using a
given version of the software which all the employees in the organization are familiar with but it
may be not working perfectly on the updated systems. In such a situation, it is very important to
safeguard those vulnerable systems, this entails cutting off the network access every time
possible and employing very strong firewalls as well as security software.
ii. Back up the data
Back up of the organization data was very difficult before the use of the cloud storage services
but now it is very possible because of the cloud storage services. Irrespective of whether one is
doing the backup online or offline, there is still some cost which the organization must incur.
Currently, nevertheless, cloud storage services are relatively faster, cheap, and simple, they are
still a business investment for any small business. Several services like iCloud and Dropbox have
fallen victim to the cyber-attacks (Goodman, 2011). Nevertheless, having the data backed up to

Corporate Governance 8
the cloud implies that one will at least be safeguarded by given types of attacks like ransomware.
Back up of data also help the organizations to retrieve the information when they get lost.
iii. Educate and train
In this practice, the business organization need to educate and train its employees how to
safeguard the system online as well as informing them the benefits of the protecting the system
against the cybercriminals (Schaefer, 2017). Cyber threats always come as fast as an individual
can imagine. The employees need to be trained on what they are doing and why it may be
dangerous to the organization is more efficacy strategy than anticipating an IT security staff to
continuously react to end user´s wrong decision. The organization should ensure that the
employees comprehend how vital the company´s information is as well as all the strategies the
organization can undertake to safeguard it.
iv. Get regular risk assessments
The organization will not actually know how to protect their system until they are actually
evaluated by an expert. Depending on where the business is located, the risk evaluation may be
done for free. For example in some countries in Europe like the UK, the governments may show
the organizations many things to do to safeguard (Sheffi, 2015). The regular cyber risk assessment
will highly help in protecting the organization from any attack which might affect the normal
operation of the business. Risk assessment helps the organization to prevent any risk before it
occurs. This further help in keeping the hackers at bay since the database of the organization will
be secured at all times.
v. Establish a strong password

Corporate Governance 9
Using the very strong password and implementing is the simplest thing the organization can do
to help strengthen the organization security. The strong password may implement the use of a
combination of a lower-case and upper-case letters, numbers, symbols, these symbols can be
made to about 8 to 12 characters long.
vi. Put up a strong firewall
Firewall is a must for any business organization which need to have a properly protected device.
The firewall will help protect the organization network by managing internet traffic flowing out
and coming into the business (Antonucci, 2017). This strong firewall will for sure enable the
business organizations to prevent any malicious data which may highly interfere with the normal
operation of the business.
vii. Installing the antivirus
For any business organization, having very effective antivirus protection will highly help them
in safeguarding their information and data. The anti-malware are essentials software in the
organization arsenal of the online security weapon. These antiviruses are the last line of the
organization defence (Institute, 2016). The antivirus helps to protect the all the computers and any
organization´s laptops. If the antivirus is not installed in the organization´s computers and
laptops then the virus may result to data loss in the business organization which in most cases
can result to losses in profit realization in the business.
viii. Secure the organization laptops

Corporate Governance 10
Since laptops are mobile and portable in nature, they are at higher risk of being lost or stolen as
compared to the organization desktops. It is very significant to have some extra steps to make
sure that the sensitive data is highly protected (National Academies of Sciences, 2014). Some
software like the encryption has changed the way the data and information appear on the hard
drive so that when there is no password, the hard drive cannot be read. The secure laptops hence
help in upholding the security of the organizations' information and protect the business from
hackers.
ix. Encrypt data
For companies holding vital information, be beyond any doubt to require actions to
continuously have this information scrambled. Using this highlight does require some added
consideration, in spite of the fact that. Typically because the encryption will as it was actuated in
scenarios a login isn't in use (Elms, 2013). For programmers, this indicates that all they need is for
an evocative to require a brief break and head over to the office kitchen in arrange to attack an
outline with malware and infection. So, to implement your measures, be beyond any doubt to set
your computers to consequently log out after five to ten minutes without utiliz (Wittkop, 2016).
These actions to encrypt information are important to take since in the worst-case scenarios
cybercriminals have been known to steal this data and encrypt it themselves.
RECOMMENDATIONS
There are several recommendations which the business organization may put aside to help them.
Such recommendations include the following:

Corporate Governance 11
i. Double down or triple down on the basics
Several business organizations underinvest in basic cyber hygiene while the massive majority of
breaches takes advantages of the fundamental controls. Directors need to ask very difficult
questions about control and policies related to the password, patches and updates from software
vendors, employee education on phishing as well as penetration testing and red team exercise.
ii. Focus on people and culture.
Cyber preparedness basically deals with people. Staff behaviour is probably is to be more
significant than the cybersecurity policies, processes as well as system combined (United Nations
Publications, 2017). The board of directors should pay more attention to the communication,
training and testing programs and also contractor behaviour and staff. This will enable the board
to monitor the business organization´s overall risk culture.
iii. Establish a cybersecurity risk policy with clear risk appetite
Cyber risk shows a clear and present danger. An inspirational policy having general guidelines is
insufficient. An efficacy rule should have a sound definition for the cyber risk exposure as well
as tolerance risk levels (Vermesan, 2013). Board of directors should organization to clearly define
the cybersecurity approaches policies and plans, encompassing the quantitative definition of peril
appetite.
iv. Ask for an effective risk report with qualitative evaluation and quantitative

Corporate Governance 12
Current survey indicates that about 91% of the board. It the duty of the management to report to
their board in a way that is so fathomable and sound (Rittinghouse, 2014). A board level cyber
peril report should comprise metrics and commentary on the threats environments, the efficacy
of main controls and general cybersecurity program, peril exposure against peril acceptable
levels.
v. Give a credible challenge and oversight of the cybersecurity program
The organization makes the decision of the business on how much cyber risk the organization is
willing to accept in pursuit of its objective and strategy (Smith, 2013). The duty of the board is to
give the oversight and governance, comprising reliable challenge on key decision and policies.
To achieve this critical role, the board of organization should have enough access to cyber
expertise and obtain assurance on their own security of their main vendor (Harris, 2013). This
assurance may comprise a third-party assessment or even through using security rating services
such as BitSight .
CONCLUSION
In conclusion, business protection is very crucial and important for any organization to
help secure the data and information about the business. The best way of protecting the business
information from hackers is through having strong cybersecurity. A strong cybersecurity keeps
these cybercriminals at aby and help promotes the thriving of the business and makes the
business to realize a lot of profit. The cybercriminals in most cases result to stealing of business´

Corporate Governance 13
resources like finances online. The cybersecurity is done through several practices as discussed
above. The board of directors will employ the above practices like install an antivirus, creating a
very strong password, installing a strong firewall.
The board of members will hence have to review and evaluate the above. You've got
profitable computerized resources, you hold individual data almost your clients and providers,
and in this time of viral social media campaigns, your organization notoriety is fragile regardless
of how pre-eminent it could be. With a very strong and reliable cybersecurity like the
aforementioned firewalls, strong password, installing antivirus, it will for sure provide a secure
platform for any business organization. This is because there is no unauthorized individual who
will access the database of that organization. The governance Cloud should permit the board of
directors to realize the demands in the organization boardrooms and also beyond with the
capability to select the goods they want, this will help them to do their best and work within the
organization allocated budgets.

Corporate Governance 14
BIBLIOGRAPHY
Antonucci, D. (2017). The Cyber Risk Handbook: Creating and Measuring Effective Cybersecurity
Capabilities (3rd ed.). Manchester: John Wiley & Sons. doi:10.100/192
Cascarino, R. E. (2012). Auditor's Guide to IT Auditing (3rd ed.). Hawaii: John Wiley & Sons. doi:10.10/121
Elms, D. K. (2013). Global Value Chains in a Changing World (3rd ed.). Hull: World Trade Organization.
doi:10.10/122
Goodman, S. (2011). Toward a Safer and More Secure Cyberspace (3rd ed.). Hull: National Academies
Press. doi:100.1000/122
Harris, S. (2013). Gray Hat Hacking (2nd ed.). Beijing: McGraw Hill Professional. doi:10.1000/128
Institute, I. G. (2016). Information Security Governance: Guidance for Boards of Directors and Executive
Management (2nd ed.). Chicago: ISACA. doi:1000.10/187
ISACA. (2013). Transforming Cybersecurity: Using COBIT 5 (4th ed.). Florida: ISACA. doi:10.1000/182
Kamar, H. (2017). what is cybersecurity (3rd ed.). Hawaii: The Rosen Publishing Group, Inc.
doi:10.100010/172
McLaughlin, M. (2015). Navigating the Digital Age: The Definitive Cybersecurity Guide for Directors and
Officers (4th ed.). London: Caxton Business & Legal, Incorporated. doi:10.1000/182
National Academies of Sciences, E. a. (2014). Enhancing the Resilience of the Nation's Electricity System
(4th ed.). Hawaii: National Academies Press. doi:10.10100/182
Rezek, C. (2015). Beyond Cybersecurity: Protecting Your Digital Business (2nd ed.). Toronto: John Wiley &
Sons. doi:10.100/173
Rittinghouse, J. (2014). Cybersecurity Operations Handbook (3rd ed.). Chicago: Digital Press.
doi:10.100/172
Schaefer, D. (2017). Cybersecurity for Industry 4.0: Analysis for Design and Manufacturing (3rd ed.).
Manchester: Springer. doi:10.10/182
Sheffi, Y. (2015). The Power of Resilience: How the Best Companies Manage the Unexpected (4th ed.).
New York: MIT Press. doi:10.10000/162
Smith, J. (2013). Managing Privacy: Information Technology and Corporate America (1st ed.). London:
UNC Press Books. doi:10.10/82
Sullivant, J. (2016). Building a Corporate Culture of Security: Strategies for Strengthening Organizational
Resiliency (1st ed.). Chicago: Elsevier Science. doi:100.1000/183
United Nations Publications, U. N. (2017). Human Development Report 2016: Human Development for
Everyone (3rd ed.). Hull: United Nations Publications. doi:10.100/193

Corporate Governance 15
Vermesan, O. (2013). Internet of Things: Converging Technologies for Smart Environments and
Integrated Ecosystems (1st ed.). Hull: River Publishers. doi:10.10/82
Wittkop, J. (2016). Building a Comprehensive IT Security Program: Practical Guidelines and Best Practices
(2nd ed.). Ottawa: Apress. doi:100.1000/2102