Financial services firms are particularly vulnerable to cyber-attacks due to their management of sensitive financial information and it’s important to understand that the Financial Conduct Authority (FCA) holds board executives accountable for any security breaches. The FCA has strict requirements, and demands a top-down approach from board members, where they must show they are being proactive to protect the organisation, such as;
- Ensuring cyber risks are included on the executive agenda
- Demonstrating they are educating executives to mitigate risks
- Presenting high-quality management information in useful and digestible formats.
This can be a challenge for the board as they tend not to be technical or cyber-aware individuals which may leave them exposed. It is recommended therefore that IT and security leaders work with them to advise and guide them on impending cyber risks.
But where does the board start to ensure its firm’s cyber security strategy is robust and meets FCA standards? The FCA suggest a good place to start to navigate these challenges, is to turn to external guidance from the National Cyber Security Centre (NCSC), specifically Cyber Security Toolkit for Boards.
What is the NCSC Cyber Security Toolkit for Boards?
The NCSC Cyber Security Toolkit for Boards is a comprehensive resource designed to help board members engage effectively with cyber security issues. Its key features include:
Resources: The toolkit includes briefing packs, videos, and essential questions that guide boards in evaluating their cyber security posture.
Accessibility: It aims to simplify complex cyber security concepts, making them understandable and relevant for non-technical board members.
Governance support: By providing structured guidance, the toolkit empowers boards to oversee cyber risks effectively and make informed decisions that align with their organisation’s strategic objectives.
It can be found here:
https://www.ncsc.gov.uk/collection/board-toolkit#whatisbtk
Three steps to implement Cyber Security Toolkit for Boards
Step 1: How to present cyber security to the board
The toolkit provides answers to key questions board members may be asking, including: What is cyber security? What is your responsibility as a board member? How might you be targeted? What do you need to know and why are you at risk?
Step 2: Familiarise the board with the toolkit
A helpful briefing pack is available to help board members familiarise themselves with the toolkit and is available online here:
https://www.ncsc.gov.uk/collection/board-toolkit/toolkits-toolbox/briefing-packs
There is also a useful document called ‘Cyber security 101’ which provides board members a sample script of questions to discuss at the next board meeting. It helps them to find out whether they have enough cyber security knowledge to have constructive discussions with key staff to ensure the organisation has appropriate plans in place to mitigate cyber threats.
Step 3: Follow the three main sections in the toolkit
1. Create the right environment
This first part is a guide to establishing a supportive culture for cyber security within the organisation, including:
- Embedding cyber security: Integrating cyber security practices into the organisation’s overall strategy.
- Developing a positive cyber security culture: Fostering an environment where all employees understand and prioritise cyber security.
- Growing cyber security expertise: Ensuring that board members and staff have the necessary knowledge and skills to address cyber risks.
2. Get the right information to support decision making
This part emphasises the importance of informed decision-making based on accurate data, including:
- Identifying critical assets: Understanding which assets are vital to the organisation’s operations.
- Understanding cyber security threats: Gaining insights into the types of threats the organisation may face.
- Evaluating and prioritising risks: Using the gathered information to assess and prioritise cyber risks effectively.
3. Take steps to manage those risks
The final section outlines actionable steps for managing identified risks, including:
- Implementing effective cyber security measures: Establishing robust security protocols and practices.
- Collaborating with supply chain and partners: Ensuring that third-party relationships are secure and compliant.
- Planning for cyber incidents: Developing response plans to address potential cyber incidents swiftly and effectively.
The NCSC Cyber Security Toolkit for Boards is an essential resource for financial services firms aiming to enhance their cyber resilience. By integrating cyber security into their strategic discussions, boards can ensure that their organisations are well-prepared to face the evolving landscape of cyber threats. Embracing this toolkit is a proactive step towards safeguarding not just data, but also the trust of customers and stakeholders.
