Cybersecurity: what is senior management's role in protecting the business?

When an attack brings operations to a halt, the questions raised in the first hours are business questions, and the board and executive team are the ones who need to answer them. That is why preparation needs to involve them as well.

October is Cybersecurity Awareness Month, and campaigns usually speak to employees about passwords, suspicious emails and links. This work matters. Even so, much of a company's exposure is determined far from the technology department: in budget approvals, in vendor contracting and in choosing which processes are considered critical. One of the questions we hear most often from CFOs and board members is how far management's responsibility extends on this issue.

When systems go down, the decisions are business decisions

An incident can prevent a company from invoicing, delay deliveries and block access to its own financial information. At the same time, someone has to decide how to communicate with customers and banks and whether to notify the ANPD, Brazil's data protection authority. These decisions involve contracts, cash and reputation, and they rarely fall to the technical team alone.

The risk that comes in through vendors

A growing share of incidents begins with a software vendor, a service provider with remote access or a partner that shares data. When a company outsources an activity, it remains exposed to the risk, and control comes from criteria defined at the time of contracting:

• assessing the vendor's security maturity;

• setting contractual deadlines for incident notification;

• periodically reviewing the access granted.

Who owns cyber risk

In governance, the starting point is defining who owns cyber risk, how often the topic reaches the board and based on which indicators. Access management, segregation of duties and tested backups are controls closely related to the financial controls the CFO already monitors. In companies subject to SOX, the US internal controls law, IT controls fall within the same scope of assessment.

The business continuity and incident response plan completes this framework. It defines which processes are restored first and how quickly, and it establishes before a crisis who authorizes shutting down systems, who speaks with customers and when to bring in the legal team. Companies that run these scenarios with senior management present tend to respond in a more coordinated way, because the difficult decisions have already been discussed calmly.

The CFO's role

The CFO translates risk into figures the board can assess, such as the cost of days of downtime, the effect on contracts with service level agreements and the coverage of cyber insurance. As Dail Song, partner responsible for Risk Advisory at VBR Brasil, puts it: "Cybersecurity makes it onto the board's agenda the day someone asks how much it costs to go three days without systems. Ideally, that calculation is done beforehand."

How VBR supports this agenda

Within Risk Advisory, VBR works in cybersecurity in partnership with CT360, providing vulnerability assessments, penetration testing, continuous monitoring and incident response. This work connects with governance, risk and compliance (GRC) and with SOX and IT SOX control assessments, so that digital security becomes part of the company's governance structure.

If your board and executive team want to understand the company's level of exposure and how to prepare, contact VBR's team through the link in our bio or via our institutional website.