A Proactive and Pragmatic Approach to Cyber Risk Management

A number of regulations focused on improving cybersecurity programs have been introduced over the past few years, including a recent regulation finalized by the New York Department of Financial Services (NYDFS) requiring banks, insurance companies, and other NYDFS-regulated entities to establish and maintain an effective cyber risk management program. Still, the magnitude of stolen information remains staggering, and the challenges associated with protecting data continue to grow.

Not all cyberattacks are made public, but it seems as though a new breach makes headlines every day. Only recently has a comprehensive framework for reporting cyber risk management activities become available: The American Institute of Certified Public Accountants (AICPA) recently released a new attestation reporting framework intended to help organizations evaluate and report on their cyber risk management programs. Designed to expand cyber-risk reporting to a broad range of internal and external users, including the C-suite and the board, the AICPA’s new reporting framework aims to provide in-depth, easily consumable information about an organization’s cyber risk management program.