Skip to content

ACCA Strategic Professional · Strategic Business Leader · IT systems security and control

Halden Logistics has suffered two phishing incidents this year. The board has so far treated cyber security as a technical matter for the IT department and has not discussed it at board level. A non-executive director argues that this approach is inadequate. Which action best reflects good cyber security governance?

Good governance makes the board accountable for cyber risk appetite and oversight, supported by regular management reporting. Cyber risk is a business-wide strategic risk, not just a technical issue, so delegating it wholly to IT or relying on insurance leaves accountability and wider impacts unmanaged.

  1. ADelegate all cyber risk decisions to the IT manager and ask for an annual summary of incidents
  2. BMake the board accountable for setting cyber risk appetite and oversight, with regular reporting on cyber risk from managementCorrect
  3. CBuy cyber insurance so that the financial consequences of an incident are transferred and no further board oversight is needed
  4. DRestrict cyber security policy to the IT department's operating procedures, as employees are not part of the control environment

Explanation

Cyber risk is a strategic business risk, so the board should own risk appetite and oversight and receive regular management reporting. Delegating everything to IT removes accountability. Insurance only transfers part of the financial loss and does not remove reputational, legal or operational exposure or the need for oversight.

Did you get it right without looking?

One question tells you little. A timed set on IT systems security and control shows your real accuracy, how long you take and where you lose marks.

Practise IT systems security and controlFree diagnostic mock

More IT systems security and control questions