How to get your board and executive team cyber-ready and achieve a culture of cyber security from the board down: The CEO Method™ for breach prevention

Abstract

Most boards and executive teams do not know how to achieve a culture of cyber security in their organisations, which puts company assets and ROI at risk. Many also do not know how to behave securely in all areas of their lives, much less what their role in driving the cyber security strategy of their organisation is or should be, which further drives up the risk. Given that culture always starts at the top, this paper teaches CEOs, board chairs, their CISOs, as well as other board directors, C-suite executives and their Investors, the CEO-driven yet decentralised, board-down method for breach prevention, getting all board directors and C-Suite executives cyber-ready to execute their part and creating a culture of cyber security from the board down, thus also helping organisations alleviate the pressure on CISOs as the focal point of creating and sustaining cultures of cyber security and serving as an indispensable complement to CISOs’ work of cyber-securing the IT and OT infrastructure of organisations. This method, called The CEO Method™, was invented by global tech and defence investment banker, entrepreneur, US Congressional adviser, Wharton and Harvard alum Andrzej Cetnarski, Chairman, CEO and Founder of Cyber Nation Central®, global cyber security protocol education, insights and advisory company dedicated to creating cyber-secure-by-design boards, executive teams and organisations. Cetnarski invented The CEO Method™ and its protocol process in response to a fatal breach of his first venture, where even the most cyber-secure technology and best-performing CTO were not able to prevent a breach caused by lack of understanding by the board, C-suite and blue-chip investors of what a true culture of cyber security entailed, allowing the threat actors to take advantage of the still-very-typical-of-boards-and-investors-today gap in cyber security knowledge and awareness, further exacerbated by a still-CISO-centric approach to cyber security. In so doing, this paper also teaches its readers the process for bridging the widening gap between CISO, regulatory compliance and technology as ‘the answer’ versus actual hacker-deterrent cultures of decentralised cyber security, individual ownership of cyber-specific fiduciary roles and tactical responsibilities, ‘partnership with’ instead of ‘over-reliance on’ the CISO and mastery of individual risk and response, individual cyber security and organisational cyber-strategy and each board director’s and executive’s role in it. This paper covers the answers to ‘Why and how should CEOs, board chairs and CISOs treat breach prevention readiness differently than they are now?’, ‘Why and how is the core concept of cyber security different than what most boards and C-suites think it Is?’ and ‘What do boards and C-suites need to be doing differently to close the gap between the 37.5 per cent chance of breach and US$10mm average cost of breach and actual breach deterrence?’