Shruti Kalsi

Technology is ever changing and it becomes important to keep a check on the changing environment. What new technology the company is headed to and adopting, what are some inherent risks associated with it as well as evaluating how much the company is prepared for address those amd if uts going to impact the compliance.

Start by identifying business objectives and priorities, and then strategize on how to align security with business objectives. Based on the company's need or requirement, is it good it build securiity program in house or outsource or opt for a hybrid model, where some services are outsourced and some are developed in house. Prioritzing the must have vs nice to have. Identifying sensitive data lakes and protecting whats revenue generating for business. Focus should be on creating an efficient program, capturing KPIs that would drive security program towards maturity, bringing great ROIs.

For non technical stakeholders it is hard to grasp the real issues underlying in security metrics such as the number of critical vulnerabilities found in production and now need remediation. I believe the key is to let them know the impact. The impact could be reputational or financial. For example what will happen if these are not remediated. Is it going to impact the next audit or SOC assessment? Explaining the impact of not taking an action also determines the impact on business value.

This is the very first and crucial step in identifying what needs to be protected. Often times organizations have sensitive data on servers that they even know about or assets not under the perimeter. Identifying such assests provides a path forward to take evaluate their risk posture and action on security.

Apart from being a cybersecurity professional with cyber underatanding, understand the goals of the business, inculcate a business mindset where cyber supports the business rather than just become a cost center. Clearly define KPIs that would help the cyber program become mature and effectively communicate with cross functional teams like IT, HR as well as C Suite

One of the ways to include cyber in a board level discussion is to communicate in a language that the board understands. It is absolutely important to first choose the indicators that would could contribute towards maturing the cyber program at the Company over the 2-4 years and then effectively communicating to the board on why these security indicators are important and the impact they would be pressing.