Top Managers Increasingly Asked to Sit in on Cybersecurity Meetings

• Eight in 10 organizations report that their cybersecurity practices are improving
• Executives, directors, business units and outside firms are now directly engaged in conversations and decisions on cybersecurity matters
• COVID-19 and the shift to remote work have heightened awareness of the need for strong cybersecurity

New research indicates that organizations are building confidence in their cybersecurity practices and technologies – so much so that upper management is getting directly involved in strengthening their organizations’ security posture.

Cybersecurity has become a boardroom topic in recent years. COVID-19 and the massive shift to remote work have further fueled awareness of the need for strong cybersecurity measures. For some companies, the pandemic has merely accelerated changes that were well underway.

Executives, directors, business units and outside firms – in addition to IT personnel – are now directly engaged in conversations and decisions on cybersecurity matters, according to CompTIA's State of Cybersecurity 2020 report.

Eight in 10 organizations say their cybersecurity practices are improving, aided by advanced technologies, more detailed processes, comprehensive education and specialized skills.

“As a result, companies have a better understanding of what do about cybersecurity … The ‘cybersecurity chain’ has expanded to include upper management, boards of directors, business units and outside firms in addition to IT personnel in conversations and decisions,” according to the research.

Interestingly, the report also reveals that 45% of large companies, 41% of mid-sized firms and 37% of small businesses have a cyber insurance policy. Among the coverage areas, researchers mention restoring data, third-party incidents and response to ransomware. However, in a notice sent this month, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC)warned that companies may face sanctions if they give in to the demands of ransomware operators, including entities that carry out negotiations and payments, as well as cyber insurers.