Article
How to engage CFOs in information security programs
Aug. 17, 2021 · Authored by Bryan Schader and Findley Gillespie
Business information security is a major financial risk. It’s crucial for finance executives to factor information security considerations into risk-mitigation controls to obtain a complete picture of all the potential risks your organization faces.
Below, explore the benefits of an information security program, what a strong program looks like, and ways you can assess and validate existing controls to develop and improve your organization’s security framework. First, to stress the importance of improving security, there’s a quick reminder of how costly a data breach could be for your organization.
What are the financial consequences of a data breach?
Data breaches happen more frequently in today’s business landscape — and they’re expensive. 30% of major security incidents result in damages between $100,000 to $500,000 according to the 2020 Insider Threat Report from Cybersecurity Insiders. Business email compromise scams alone have results in over 166,000 incidents around the world and $26 billion in loss since 2013, according to the 2020 Trustwave Global Security Report.
Recovery costs can exceed estimates very quickly. Information security should be considered a high-level risk because of its financial implications; it can directly affect an organization’s bottom line.
Beyond direct financial loss, other potential financial consequences include:
- Reputation damage
- Intellectual property theft
- Regulatory fines
Cybersecurity insurance may be able to help you recoup direct financial loss, but it won’t protect against intellectual property losses or a hit to your organization’s reputation.
What is an information security program?
An information security programs supports an organization’s technology framework by protecting IT assets, data, and business processes.
What are the steps of the information security program lifecycle?
Financial executives regularly decide which risk mitigation controls to implement based on risk trade-offs and regulatory pressures using a risk management framework.
