Cyber-risk moves to the top of the CFO’s agenda

It is all too easy to think of the chief finan­cial offi­cer (CFO) as being the C‑suite accoun­tant, albeit a very pow­er­ful and well-paid one. While the clue is in the job title and man­ag­ing the com­pa­ny’s finances is cer­tain­ly the pri­ma­ry role, there’s more to the mod­ern CFO than just bal­anc­ing the books. Sure, man­ag­ing cash flows and over­see­ing bud­getary plan­ning remain cen­tral to the CFO role, but times are chang­ing and CFOs must change as well.

I insist on being an active mem­ber of the secu­ri­ty team to eval­u­ate our cyber­se­cu­ri­ty pos­ture and most crit­i­cal assets, and under­stand our expo­sure

Respon­si­bil­i­ty for finan­cial risk man­age­ment is increas­ing­ly expand­ing into the more strate­gic realm of cyber-risk man­age­ment and reg­u­la­to­ry com­pli­ance respon­si­bil­i­ty is embrac­ing more than just ensur­ing that account­ing check­box­es are ticked.

With most organ­i­sa­tions now in a state of per­pet­u­al change, dri­ven by the need for true dig­i­tal trans­for­ma­tion that pro­found­ly touch­es upon every aspect of the busi­ness, the C‑suite has high expec­ta­tions of what the CFO must deliv­er. To meet those expec­ta­tions, should we now be defin­ing the chief executive’s de fac­to sec­ond in com­mand as the cyber CFO?

GDPR has added cyber-risk to the CFO’s priorities

The CFO needs to not only man­age the basic finance func­tion, but iden­ti­fy areas for growth and oper­a­tional excel­lence across all domains. “One of these areas is being an ecosys­tem pro­tec­tor,” says Col­by Moos­man, CFO of bio­met­ric iden­ti­ty ver­i­fi­ca­tion com­pa­ny Jumio. “As we become more teth­ered to the inter­net, more of our busi­ness and more of our cus­tomers are becom­ing part of a dig­i­tal ecosys­tem, which is under con­stant threat from cyber­crim­i­nals, mal­ware, fraud­sters and social engi­neer­ing.”

With the light from the Euro­pean Union Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR) shin­ing into the dark­est cor­po­rate cor­ners and illu­mi­nat­ing the poten­tial for fines that will impact the bot­tom line, Mr Moos­man insists it’s now “incum­bent on the CFO to pro­tect the pri­va­cy and the data cap­tured on users”.

Ning Wang, CFO of hack­er-pow­ered secu­ri­ty test­ing com­pa­ny HackerOne, agrees that the evolv­ing reg­u­la­to­ry and audit envi­ron­ment GDPR brings to the organ­i­sa­tion means that all CFOs must be famil­iar with ensur­ing com­pli­ance across all busi­ness units. At HackerOne, for exam­ple, GDPR-relat­ed train­ing is now part of employ­ee onboard­ing.

“We reg­u­lar­ly edu­cate our staff on how to han­dle per­son­al data to increase aware­ness and sen­si­tiv­i­ty,” says Ms Wang, as that helps the com­pa­ny to stay com­pli­ant. “The CFO role in rela­tion to cyber-risk and com­pli­ance becomes more oper­a­tional in that regard, rather than siloed in finan­cials.”

CFOs need to know the right questions to ask around cyber-risk

This is an impor­tant acknowl­edge­ment and one that is cen­tral to the case for a cyber CFO mov­ing for­ward. You might think this could lead to there being some wor­ried CFOs who are con­cerned their career could be career­ing off the rails, with this shift towards an entire­ly new skillset to add to their CVs.

But that’s not the impres­sion you get talk­ing to those who are active­ly walk­ing the walk. “It’s tru­ly an excit­ing time to be a CFO,” says Steve Vintz, CFO with cyber-expo­sure experts Ten­able, who argues they sim­ply need to under­stand their expo­sure to cyber-risk and the finan­cial costs asso­ci­at­ed with it.

“I don’t pre­tend to under­stand the tech­nol­o­gy to the same degree as a chief infor­ma­tion offi­cer (CIO) or chief infor­ma­tion secu­ri­ty offi­cer (CISO), but I insist on being an active mem­ber of the secu­ri­ty team to eval­u­ate our cyber­se­cu­ri­ty pos­ture and most crit­i­cal assets, and under­stand our expo­sure.”

Wait a minute, so should cyber­se­cu­ri­ty be the CFO’s job in future? No, the respon­si­bil­i­ty for cyber­se­cu­ri­ty must still fall under the secu­ri­ty team, which includes the CISO, CIO and the myr­i­ad oth­er roles involved with pro­tect­ing the organ­i­sa­tion from cyber­at­tacks.

“But CFOs need to know what ques­tions to ask their secu­ri­ty team, what to look for and under­stand the addi­tion­al dis­clo­sure require­ments that are now part of the finan­cial state­ments,” says Guy Melamed, CFO and chief oper­at­ing offi­cer at data secu­ri­ty com­pa­ny Varo­nis Sys­tems.

Being clued up on cyber-risk can help CFOs budget for the worst case

The argu­ment is that CFOs, CIOs and CISOs share many of the same goals to pro­tect their organ­i­sa­tion from cyber­at­tacks and oth­er threats, and if CFOs are aware of the cyber-risk they can, accord­ing to Mr Melamed, “do what they do prob­a­bly hun­dreds of time a day: a cost-ben­e­fit analy­sis to ensure the right deci­sions are made to reduce risk and to ensure resources are allo­cat­ed prop­er­ly”.

Shar­ing goals is one thing, shar­ing respon­si­bil­i­ty anoth­er in a rela­tion­ship, which all too often appears to be defined by squab­bles over resources as bud­gets are squeezed. Yet that rela­tion­ship is key if the busi­ness is to suc­ceed. Which means, as James Arm­strong, CFO at dig­i­tal trans­for­ma­tion spe­cial­ists 6point6, points out: “The CFO and CIO/CISO need to be 100 per cent in tune.” Indeed, the CFO has a duty of care to hold the CIO/CISO to account and under­stand cyber-risk and its poten­tial impact on the busi­ness.

How­ev­er, when exec­u­tives con­sid­er fraud or cyber­at­tack, many think only in terms of direct finan­cial loss. The for­ward-think­ing future CFO must take account of the longer-term impacts. “Hav­ing a plan in place that is led by a poten­tial cyber CFO well in advance of any breach will mit­i­gate rep­u­ta­tion­al and legal impacts,” Jim Gee, nation­al head of foren­sic ser­vices at risk advi­so­ry firm Crowe, con­cludes.