We’ve said it before and we’ll say it again: cybersecurity is a team sport. That means that (like it or not) the responsibility and burden sits with everyone, including the Chief Finance Officer (CFO). 

That’s right: quantifying cyber risk, navigating cyber insurance policies, and negotiating ransom with hacking groups can all be part of the job spec. 

If you’re a CFO who’s struggling to understand their role in cybersecurity, keep reading. We share 7 opportunities to get involved and protect your company’s assets. 

Note: Every company is different. Size, revenue, industry, and reporting structures all play a role. This is general advice meant to provide a bird’s eye view of a CFO’s potential involvement in cybersecurity.

1. Quantify risk

It can be hard for the C-suite to see the value of a solution when they haven’t yet experienced any consequences without it. As the saying goes, “If it ain’t broke, don’t fix it”. 

That’s why it’s so important CFOs step in to quantify risk using specific “what-if” scenarios.

The most basic formula is: probability x expected cost.

Let’s use the example of an email being sent to the wrong person. We know at least 800 misdirected emails are sent every year in organizations with 1,000 employees. The expected cost, of course, depends on the email content and recipient, but let’s look at the worst-case scenario.

What would the cost be if your press release for an upcoming, highly confidential merger and acquisition landed in a disgruntled former employee’s inbox? How would this impact the M&A itself? The company’s reputation? Revenue? Not a risk worth taking.

Learn more about the key security challenges organizations face during M&A events.

2. Benchmark spending against other organizations

Just like a marketing team should use a benchmark to determine whether or not their email list is engaged, CFOs should use a benchmark to determine how much they should be spending on cybersecurity. Think of it as your North Star.

Fortunately, it’s relatively easy to determine how much your competitors or industry mavericks are shelling out. At least if they’re publicly traded. 

A good place to start is their S-1. Here, you’ll be able to see what percentage of the company’s revenue goes towards Sales and Marketing, Research and Development, and General and Administrative. 

This should give you a good idea of how to allocate your revenue. 

You can also look at more general benchmark reports. For example, according to a Deloitte study, cybersecurity spending has increased YoY, from .34% of a company’s overall revenue in 2019 to .48% in 2020. 

In 2020, that equated to $2,691 per full-time employee.  

Bonus: Did you know you can also benchmark your security posture against your industry peers with Tessian Human Layer Security Intelligence? Learn more. 

3. Vet cyber insurance policies

Today, virtually every business needs cyber liability insurance. If you run a business that stores client, customer, or partner data…you need it. But it’s money wasted if you aren’t fully familiar with the policy terms.

Check to make sure your first-party cyber insurance includes:

• Breach response recovery (including technical and legal advice)
• Forensic analysis for identifying the attack source
• Event management (including data recovery, PR services, and notification of clients)
• Cyber extortion
• Network/business interruption (including those that are the result of an attack on a third party)
• Dependent business interruption
• Credit monitoring services
• Consequential reputational loss or loss of income

It’s also worth exploring third-party cyber insurance to protect your company’s assets from subsequent compliance penalties and settlement costs. 

For example, Facebook settled a class-action lawsuit over its use of facial recognition technology. Illinois. The case reportedly settled for $550 million for a violation of the Biometric Information Privacy Act. 

Third-party cyber insurance should include:

• Network security failures and privacy events
• Regulatory defense and penalties (including coverage for GDPR liabilities)
• PCI-DSS liabilities and costs
• Media content liability 

4. Communicate with the board

In a sentence, the CFO is responsible for the financial security of an organization. And, in the event of a breach, financial security simply isn’t guaranteed.

Don’t believe us? Check out the consequences of a breach, according to IT leaders:

[infogram id=”for-blog-1h7v4pwwm1l5j6k?live”]

All of these will impact a company’s bottom line, including share value and rate of growth… two things the board doesn’t want to hear and news a CFO would hate to deliver.  

But this isn’t a case of shooting the messenger. The responsibility and burden of cybersecurity sits with everyone, remember? 

Post-breach, the board, auditors, and other third parties will be examining how effectively budgets were allocated to prevent the worst. That’s why it’s essential the CFO is actively involved in creating and implementing cybersecurity strategies; they have skin in the game. 

5. Create secure processes for the finance team

While – yes – the CFO holds the power of the purse and therefore influences the overall cybersecurity strategy, they also have a massive responsibility to secure their own team’s processes.

After all, the finance department is one of the most targeted, specifically by invoice fraud, wire transfer fraud, and business email compromise. 

• Between June 2016 and July 2019, FBI statistics show that wire transfer fraud via BEC occurred 166,349 times, and cost businesses over $26 billion.
• In 2019, the number of bank transfer phishing scams occurring in the UK increased by 40%.
• In 2017, the FBI received 15,690 complaints about BEC (primarily involving wire transfer), resulting in over $675 million in losses. In 2019, this increased to 23,775 complaints and over $1.7 billion in losses.

To protect against these incidents, CFOs should work with security teams to help train employees to spot scams, implement email security software to spot suspicious domains, and create fool-proof payment validation processes.

For more tips, check out this article: Everything You Need to Know About Wire Transfer Phishing.

6. Negotiate ransom in the event of a ransomware attack 

This is a position no CFO wants to be in. But, more and more, we’re seeing organizations being forced to comply with cyber criminals’ extortion demands. (7 Examples of Ransomware Attacks here.)

While this may seem far beyond the scope of a finance director’s role, they’re heavily involved in the process. Of course, the first question to answer is: To pay? Or not to pay?

This depends on an infinite number of factors, including the data being held, the hacking group who infiltrated the network, your cyber insurance policy, the company’s liquid assets…. 

The list goes on. 

To avoid being put between a rock and a hard place, CFOs (along with the rest of the C-Suite and security team) should take prevention seriously, including anti-malware software, patching processes, and security for email, web, and other services. Tessian can help with email by preventing ransomware attacks at the source.

7. Know how to spot a phish

CFO’s are generally among the most frequently targeted by phishing attacks. They’re also frequently impersonated. It makes sense. They have access to and control over the company’s money.

It’s essential, then, that CFOs are especially vigilant, know how to spot a spear phishing attack, and know what to do if they suspect an email, text, or call is malicious. 

Training, technology, and processes can help. If you want to learn more about how Nudge theory plays a role, check out this article about in-the-moment warnings.

Looking for more resources? Check out the following:

⚡ Relationship 15: A Framework to Help Security Leaders Influence Change

⚡ CEO’s Guide to Data Protection and Compliance

⚡ Who Are the Most Likely Targets of Spear Phishing Attacks?

⚡ Why Information Security Must Be a Priority for GCs in 2021