Who Is Responsible for Cybersecurity?

Abstract

The question “Who is responsible for cybersecurity?” addresses how cyber risk prevention and resilience is not a one-person show: it takes a village to reduce organizational cyber risk. A case study opens the chapter by examining the immense hack of Equifax and the company’s poor cyber leadership during and after the data breach. It details the importance of strong leadership and educates readers on achieving accountable leadership for cyber risk. Afterward, it teaches readers about an organization’s enterprise information security policy and outlines the components of a cybersecurity culture. Topics include transparency, accountability, appropriate system knowledge, compliance with policy and procedure, and formal communication channels. The chapter guides executives in budgeting and allocating resources to cyber risk management and explains third-party agreements for cyber risk. It also details the importance of cyber talent management. The chapter concludes with Rosenbach’s Embedded Endurance strategy experience with cyber risk leadership at the U.S. Department of Défense.