Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

If…, then how…

If the board asks how we compare with our peers, then how do I answer?

3 decision pointsThe pack behind this answer: Board Cybersecurity Reporting

Add to board memo

The short answer

Recommendation
Say what can honestly be compared, from which source and how reliable it is, and where you are ahead and behind. If there is no reliable peer data, say so, and bring the answer back to the board's own appetite, which sets the standard.
Reasoning
Directors use peers to calibrate: they want to know whether the organisation is an outlier. The danger is answering with a number nobody can defend, which then sits in the minutes as fact. The same question can mean different things, such as spending, an external rating, a breach at a peer or controls overall, and each has a different honest answer. Being better than average can still leave a risk outside appetite, and being worse than a peer may still be within it, so the board's appetite is the yardstick.
Considerations
  • CISO Times does not supply peer benchmarks or survey figures. Any comparison has to come from a source you can name and date, such as a sector survey, a regulator report or an industry group. Never quote a vendor's survey as fact.
  • Spending is set by the risks the board wants within appetite, not by a benchmark. Do not quote a percentage-of-IT-budget figure as if it answered the question.
  • An external rating usually measures what can be seen from outside. Do not dismiss it outright, and do not adopt it as a board measure without a target.
  • If you need a figure or a check you do not have, commit to a date instead of estimating aloud.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA director asks how we compare with our peersDecisionWhat does the director want to compare?StepExplain that spend follows the risks, not a benchmarkStepExplain what the external rating does and does not seeStepCheck whether the same route into a peer exists hereDecisionDo you have peer data from a reliable source you can name?StepSay there is no reliable comparison, rather than invent oneStepName the source, then say where we are ahead and behindStepBring it back to the board's own appetiteDecisionDid you promise a figure or a check you did not have?OutcomeSend the answer by the date you gaveOutcomeAnswered, with the source stated and the appetite as yardstick

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 12 steps.

  1. Start

    A director asks how we compare with our peers

    Directors use peers to calibrate: they want to know whether the organisation is an outlier. It is a fair question. The danger is answering it with a number nobody can defend, which then sits in the minutes as fact.

    In the pack

  2. Decision

    What does the director want to compare?

    The same words can mean different questions: how much we spend, what an outside rating says about us, whether a breach at a peer could happen here, or how our controls stand against similar organisations. Ask, if it is not clear. Each has a different honest answer.

    In the pack

  3. Step

    Explain that spend follows the risks, not a benchmark

    There is no correct figure, and directors know it. Say that spending is set by the risks the board wants within appetite, what the current spend buys, and what would change at a higher or lower level. Do not quote a percentage-of-IT-budget benchmark as if it answered the question. Use peer figures only from a reliable source, labelled as such.

    In the pack

  4. Step

    Explain what the external rating does and does not see

    A rating usually measures what can be seen from outside. Say what it measures, what it misses, the current score if known, and whether the findings behind it touch the top risks. Do not dismiss ratings outright, and do not adopt one as a board measure without a target.

    In the pack

  5. Step

    Check whether the same route into a peer exists here

    Say what is known about how it happened, in two sentences. Then whether the same route exists here, checked and not assumed: yes, partly or no, with the reason, and what is being done. If it has not been checked yet, say when it will be. Never say 'it couldn't happen here'.

    In the pack

  6. Decision

    Do you have peer data from a reliable source you can name?

    Reliable sources include sector surveys, regulator reports and industry groups, each labelled with its source and date. Never quote a vendor's survey as fact. If you are not sure the data will stand up, treat it as unreliable.

    In the pack

  7. Step

    Say there is no reliable comparison, rather than invent one

    'I don't know' is an acceptable answer when it is followed by what you would need to find out, and when. Inventing a comparison is the trap. What you can offer instead is the position against the board's own appetite, which does not depend on anyone else's figures.

    In the pack

  8. Step

    Name the source, then say where we are ahead and behind

    Say what can be compared honestly, from which source, how recent it is and how reliable. Then where the organisation is ahead and where it is behind. Label each statement as a fact, an estimate or your opinion.

    In the pack

  9. Step

    Bring it back to the board's own appetite

    Close by reminding the board that its appetite, not a peer average, sets the standard. Being better than average can still leave a risk outside appetite; being worse than a peer may still be within it. The appetite is the yardstick every report is measured against.

    In the pack

    See also

  10. Decision

    Did you promise a figure or a check you did not have?

    A figure said in the meeting goes in the minutes and outlives the meeting. If the director needs a number you do not have, or a check that has not yet been made, commit to a date rather than estimating aloud.

    In the pack

  11. Outcome

    Send the answer by the date you gave

    Give a date, normally within 5 working days in the pack's defaults, and have it recorded as an action. Send a one-page written answer to the chair through the board secretary, with its source.

    In the pack

  12. Outcome

    Answered, with the source stated and the appetite as yardstick

    The board has a comparison it can trust, or an honest statement that none exists, and knows its own appetite is the test. Add the question and the answer that worked to your own copy of the question bank.

    In the pack

Practical checklist

  1. Ask what the director wants to compare, if it is not clear.
  2. For spending, explain what the current spend buys and what would change at a higher or lower level.
  3. For an external rating, say what it measures, what it misses, the current score if known, and whether its findings touch the top risks.
  4. For a breach at a peer, say how it happened and whether the same route exists here, checked and not assumed, or when it will be checked.
  5. For controls overall, check you have peer data from a reliable source you can name. If not, say there is no reliable comparison.
  6. Name the source and its date, say where you are ahead and behind, and label facts, estimates and opinions.
  7. Close by bringing the answer back to the board's own appetite.
  8. Send any promised figure in a one-page written answer to the chair through the board secretary by the date you gave.

Evidence to have ready

  • Any peer data used, labelled with its source and date.
  • Any external rating reports received, with the findings checked.
  • The minuted question and the answer given, and any action recorded for a follow-up.
  • The written follow-up sent to the chair, with its source.

Assumptions

  • The board has set a cyber risk appetite, so there is a standard of its own to return to.
  • CISO Times does not supply peer benchmarks or survey figures. Any comparison has to come from a source you can name and date.

Not covered here