Download the newest edition of the “cyber-risk oversight handbook”
In 2014 NACD published the first edition of the “Cyber-Risk Handbook” in conjunction with the ISA and AIG.
The Handbook has proven to be one of NACD’s most popular publications and was the first private-sector resource featured on the Department of Homeland Security’s C3 Voluntary Program’s Getting Started for Business website.
We issued a significantly updated version in 2017 that includes new information on the threat environment, legal developments, and current statistics on board-level cybersecurity oversight practices, along with expanded tools for directors.
This publication has been independently assessed by PricewaterhouseCoopers and shown to dramatically improve enterprise cybersecurity.
“Guidelines from the NACD advise that Boards should view cyber-risks from an enterprise-wide standpoint and understand the potential legal impacts.
Boards appear to be listening to this advice. This year we saw a double-digit uptick in Board participation in most aspects of information security. Deepening Board involvement has improved cybersecurity practices in numerous ways. As more Boards participate in cybersecurity budget discussions, we saw a 24% boost in security spending. Other notable outcomes cited by survey respondents include identification of key risks, fostering an organizational culture of security and better alignment of cybersecurity with overall risk management and business goals.”-PricewaterhouseCoopers Global State of Information Security Survey 2016 (pdf)
Working together, NACD and ISA have produced a unique and successful program that addresses cybersecurity as a board level issue – not simply an IT operational issue.
Directors can leverage the handbook in a few ways:
- Learn foundational principles for board-level cyber-risk oversight that have been vetted and praised by cybersecurity leaders in the public and private sectors.
- Gain insight into issues such as how to allocate cyber-risk oversight responsibilities at the board level; the legal implications and considerations related to cybersecurity; how to set expectations with management about the organization’s cybersecurity processes; and ways to improve the dialogue between directors and management on cyber issues.
- Use the tools in the nine appendices to improve and enhance boardroom practices.