NCSC issues core questions to help boards assess cyber risk

Ciaran Martin, the CEO of the National Cyber Security Centre (NCSC), has issued five core questions boards should ask their security teams as part of a set of guidelines aimed at assessing cyber risk.

These first five questions are the first in a suite of guideline materials the NCSC plans to release to teach business leaders the basic technical details needed to understand potential threats to their firms.

Speaking at the annual CBI Cyber Security: Business Insight Conference 2018, Martin said: “There is clear evidence that business leaders have a heightened focus on cyber security and, of course, I welcome that. At the same time, there is a clear and loud demand from business for clear and simple guidance on what has been all too often, and damagingly, characterised as a complex and technical subject.”

To make cyber security issues seem less complex for corporate leaders who may not be trained in the subject, the NCSC guidelines not only advise board members on what to ask about the security of their businesses, but also what to look for in the answers.

These initial five questions were:

1. How do we defend our organisation against phishing attacks?
2. What do we do to control the use of our privileged IT accounts? 
3. How do we ensure our software and devices are up to date?
4. How do we ensure our partners and suppliers protect the information we share with them?
5. What authentication methods are used to control access to systems and data?

Cyber attacks have been growing in number over the last few years, and research has found in many cases cyber criminals are spending more money on finding weaknesses in their targets’ cyber defences than firms are spending on avoiding attacks.

The NCSC’s advice comes after the FTSE 350 Cyber governance health check report 2017 found almost 70% of boards have no training in how to deal with cyber incidents, and 10% have no plans in place should they face a cyber threat.

Martin claimed that since cyber security is now a major business risk, board members should aim to understand it “in the same way they understand financial risk, or health and safety risk”.

This means encouraging boards to ask questions about the state of cyber in their businesses to make sure they are as much a part of the discussion around security as they are other parts of the firm.

Boards were used as focus groups by the NCSC to develop appropriate guidelines that teach board members and their staff to understand, recognise and address threats to their businesses.

Martin said these were a “taster of the sort of simple, useful but technically authoritative guidance we will be putting out to business” before the launch of a broader toolkit, developed by experts in cyber security, which will be released later this year.

“We want to move on to the next level by helping you frame your defences in a way that is appropriate to the threat picture,” he said. “This means we need you to get a little bit more technical. People at board level need to understand the basics – and I stress, basics - of cyber-attacks, cyber risks and cyber defences. That’s daunting, but it is doable.”