With the ever-increasing rate at which technology is evolving, and the ever more sophisticated ways in which cyber criminals can attack your systems, it’s now a case of when and not if an attack is going to be successful for many organisations.
Cybersecurity remains a top concern in view of the rapid rise of digital disruption from artificial intelligence (AI). This impacts on both cybersecurity and fraud risks, making it essential to prepare an effective response and recovery plan, not just a strong defence.
Understanding cyber resilience
Cyber resilience refers to the ability to anticipate, withstand and recover from adverse conditions or attacks on systems. And this capability is crucial for delivering business objectives in the current cyber environment.
Board oversight and responsibilities
Stakeholders are increasingly challenging the board’s oversight role in cybersecurity, and to fulfil their responsibilities, boards should ensure that management establish high cybersecurity standards and monitor the effectiveness of these initiatives.
The board should act as a key line of defence, ensuring that cybersecurity initiatives are adequately planned and funded and that any level of remaining risk, is expressed and understood. This vital preparation is essential as cyberattacks aim to disrupt normal business operations.
Crisis management and preparedness
Boards should verify that management teams have a documented crisis management, incident response, and disaster recovery plan. This should be tested regularly, with the exercise clarifying roles and responsibilities during a crisis, making sure that decision-making processes are well-defined.
Organisational cybersecurity activities should be visible to the board through regular reporting. This should include the cybersecurity strategy and plan, staff resources, a maturity assessment, external accreditations or a plan to achieve them, a recognition of business-critical systems, cyber security training delivery and completion, outcome of staff phishing tests and cyber continuity plans.
While ensuring robust protection from attacks is crucial, boards must recognise that protection measures can only address known vulnerabilities. But cybercriminals are continually evolving and using advanced technologies including AI to exploit new weaknesses. Therefore, robust response and recovery plans are essential for maintaining operational continuity.
Emerging threats and technologies
With technology advancements, new tools are making cyberattacks easier to execute. While AI can strengthen cybersecurity measures, it can also facilitate phishing, blackmail, and misinformation campaigns.
Generative AI is providing cybercriminals with unprecedented opportunities, allowing even less sophisticated attackers to cause significant disruption.
‘Boards must take an active role in fostering cyber resilience within their organisations.’Essential questions for board members to ask:
- How do we monitor new cyber threats and understand how other organisations have responded?
- How do we assess our cyber resilience?
- How can we adapt our preparation and responses based on evolving information?
- What do our disaster recovery plans look like, and how effective have they been so far?
- Who is responsible for cyber resilience strategy implementation and who provides the oversight?
- Do all employees understand their role in cyber resilience?
- What reporting do we want to receive and when?
The value of Internal Audit in cybersecurity
Internal audit functions play a vital role in enhancing cybersecurity efforts by providing independent assurance and advisory services.
We can assess the effectiveness of cyber processes and controls, including resilience and response strategies.
The 2025 Risk in Focus report outlines several ways internal auditors can contribute, we can:
- Assess the security culture, whether training is regular and relevant, and whether the results of testing are well communicated.
- Provide assurance that staff are fully aware of hybrid attach methodologies for the impersonation of employees and that controls are robust and tested.
- Assess how well cybersecurity, identity and access risks are escalated and the effectiveness of discussions at all levels.
- Provide assurance over governance systems and processes, including risk management reporting.
- Assess the level of compliance with the National Cyber Security Centre’s Ten Steps to Cyber Security, or wider directives such as NIS2.
- Provide assurance that controls monitoring is approached holistically, to avoid blind spots, and that results have high visibility.
Contact our Internal Audit team to discuss how we can help you to safeguard against digital disruption use for the future.
