Authored by Stuart Rogers, CFO, Red Sift. RedSift were finalists in the Best Security Innovation in a SaaS Product (B2B, Small Business / SMB) category at the 2023 SaaS Awards.

In today’s increasingly connected digital world, cybersecurity is a critical concern for organizations of all sizes and industries. With rising cyber threats and attacks, businesses must prioritize protecting their sensitive information and brand reputation.

While the responsibility for cybersecurity has traditionally fallen on the IT and security teams, the modern business landscape requires CFOs and corporate finance leaders to actively engage in cybersecurity discussions with the board. The CFO’s involvement can help ensure that the organization is adequately prepared to address the financial risk associated with cyber risk.

The active participation of CFOs in cybersecurity discussions with the board is crucial for several reasons. CFOs have a comprehensive understanding of a cyberattack’s financial and operational impact on an organization. Engaging in cybersecurity conversations can provide valuable insights into the potential financial risks and establish adequate contingency plans.

In addition, CFOs can help align cybersecurity initiatives with the organization’s overall financial strategy, ensuring that resources are allocated effectively and aligned with the organization’s priorities. Lastly, as financial transparency and compliance custodians, CFOs play a vital role in enhancing governance and risk management practices, which are critical components of a robust cybersecurity framework. Therefore, their active involvement helps establish a holistic and proactive approach to cybersecurity within the organization.

The dynamic threat landscape

The current cyber threat landscape is rapidly changing with emerging threats and increasingly sophisticated attack methods that pose significant risks to organizations. Email security remains one of the greatest attack vectors for businesses on the internet, yet it is only one of many that hackers will look to exploit. From email and domains to web applications and the network perimeter, attackers will take advantage of any and all vulnerabilities across the ever-expanding attack surface.

The consequences of these brand abuse attacks can cause significant reputational and financial damage to brands, as well as negatively impact customer loyalty. According to the Federal Bureau of Investigation’s annual Internet Crime Report, phishing attacks resulted in more victims than any other cyber threat in 2022, totaling more than $52 million in financial loss.

In addition to monetary loss, a cyberattack can also cause brand reputational damage. Legal and regulatory consequences may arise if the attack involves the unauthorized access or theft of sensitive information, resulting in fines, and penalties for non-compliance with data protection regulations. The consequences of a successful cyberattack on a company can be catastrophic.

The modern CFO’s role in cybersecurity

Today, the role of the CFO is evolving to encompass more strategic responsibilities beyond traditional financial management. The CFO role has evolved from looking after the books and records to becoming a key driver of overall business strategy including cybersecurity and the financial impact of a breach. With increased reliance on technology and digital solutions, the CFO is now required to navigate complex economic systems, cybersecurity risks, and data analytics.

CFOs are responsible for leveraging new technologies to streamline financial and business processes, optimize resources, and impact the bottom line. They play an important role in identifying and mitigating financial risks associated with digital transformation and cyberattacks and ensuring compliance with data privacy and security regulations. Additionally, the modern CFO should be adept at interpreting data, leveraging new developments in technology like AI, providing strategic business guidance, and collaborating with other business leaders to drive digital innovation and transformation in their organizations.

CFOs play a vital role in proactively addressing and managing cyber risks. They can no longer afford to be reactive. Now, when you think of risk and financial risk, cyber risk is a significant part of the risk framework, giving the CFO significant responsibilities. A lot of the things a CFO does with respect to cyber risk is about understanding their investment strategy around cyber, how they can evaluate the financial risk, and possibly the expenditures one must make within the business.

The CFO has to be cognizant of all areas where cybercrime can affect the business because ultimately, it can affect its valuation. Gartner predicts spending on information security and risk management products and services to grow 11.3% to reach more than $188.3 billion in 2023.

Some examples of the impacts of cybercrime include:

• Increased insurance premiums,
• Ransom payments,
• Impairment of brand, IP, property, goodwill
• Increased borrowing costs,
• Regulatory penalties,
• Loss of customers,
• Reputational damage, and
• Increased costs to strengthen cybersecurity.

Compliance and the CFO – CISO relationship

The CFO and CISO should collaborate to develop a comprehensive cyber risk assessment, aligning strategy and investment.

New SEC cybersecurity rules require public companies to improve cybersecurity strategies, incident response processes, and communication plans. The rules emphasize the board’s role in risk management and introduce a four-day reporting timeline. As part of their responsibilities, the CFO must be aware of the legal procedures involved in an incident response plan.

The CFO and CISO should work closely together on these four areas to effectively manage cyber and financial risk:

• Build cyber risk assessments into a cyber security program.
• Ensure policies and procedures are implemented that meet/exceed minimum standards.
• Consider the unique organizational needs, how the business manages data, and what controls are in place to protect that data.
• Determine a rhythm of how a combined CFO and CISO response would work in the event of an incident, simulating incidents ahead of time.

Questions the CFO should ask The Board

To understand the risks to their business, CFOs should connect with their information security team to understand cyber risks within their business. Then they need to relay that information to the board and engage with board members by asking critical questions that evaluate the organization’s cybersecurity measures.

I recommend corporate finance leaders ask the following questions at their next board meeting to help determine the level of preparedness in safeguarding against cyber threats and budget for financial risk in the event of an attack.

1. What are my most important assets, and how are we protecting them? What layers of [cybersecurity] protection are in place at our business? 
2. How would we know that our organization has been breached? How do we detect a breach?
3. What is our response plan in the event of an incident?
4. What is the board’s role in the event of an incident? 
5. What is our business recovery plan in the event of an incident? 
6. Is our cybersecurity investment sufficient? 

Board-level cybersecurity discussions with the CFO

Cybersecurity is an organizational issue, not just a technical issue. Benefits of the CFO actively engaging with the board and C-suite in discussions around cybersecurity are:

• Fostering a culture of cybersecurity and risk management, allowing for more time spent on strategic decision-making.
• Increasing awareness and understanding of the potential financial impact of cyber risks, enabling the allocation of sufficient budgeting to address cyber crime.
• Enhancing communication and collaboration between the CFO and other members of the leadership team like the CISO, bringing greater understanding of the financial risks associated with cybercrime.

CFOs play a crucial role in risk management and the allocation of resources. Their financial expertise allows them to assess the potential financial impact of cyber threats and prioritize cybersecurity efforts accordingly.

Ongoing collaboration between CFOs, board members and the leadership team is important to ensure that cybersecurity/cyber risk is given proper credibility. By asking cybersecurity questions during their next board meeting, CFOs are helping to ensure their organization is financially prepared in the event of a cyber incident. This proactive approach can minimize the potential financial and reputational damage from cyberattacks.