Chapter 1 - Cybersecurity is (Not) an IT ISSUE


In short, cybersecurity needs to be understood and treated as a core business issue, much like legal and finance. No organization would make a significant business decision without consulting business and finance. In the 21st century very few business decisions ought to be made without considering their cybersecurity aspects.

There are many additional steps an organization needs to take to compre
hensively address cyber risk which will be described in succeeding chapters.

Taking the right steps entails reconsidering corporate structure (as
discussed in Chapter 3) and using modern cyber risk assessment tools that go beyond the traditional frameworks and checklists (as discussed in Chapter 4), as well as engaging personnel from across the enterprise in addressing a series of specific cyber issues (as discussed in Chapter 6).

Key Ideas
  • Organizations have made little progress in addressing cyber risk in large part because they have viewed the issue with an excessively narrow focus as just a technical/operational issue.

  • To compete in the modern economy, enterprises must engage in digital transformation.

  • Digital transformation can generate a substantial increase in growth and profitability, but can also vastly increase risk.

  • Foundational technical security measures are necessary, but alone are not sufficient to address cyber threats. Cybersecurity must be an enterprise-wide risk management issue.

  • Organizations cannot completely secure themselves, but they can manage their cyber risk with appropriate understanding, structure, investment and risk-management methods.

Combining Technology, Public Policy and Economics to Create a Sustainable System of Cybersecurity


| 703-907-7090


| 2500 Wilson Blvd, #245
Arlington, Virginia 22201


ISA provides cybersecurity expert testimony and thought leadership in government and serves as an expert witness to the press.