Assurance

• An effective governance structure with clearly defined roles and responsibilities and agreed frequency and reporting metrics for the executive and board. A formal process to raise issues, resolve conflicts, enable collaboration and ensure a consistent application of the overarching policy across the enterprise.
• Ensuring cyber resilience is embedded within operating businesses, business units and subsidiaries to ensure the ownership and responsibility for managing these risks and preparing resilience strategies lies with the areas who ‘own the risk’.

• Ensuring cyber security plans and cyber resilience capability are aligned with all current regulatory requirements and standards.
• Ensuring investments into cyber security and cyber resilience meet the responsibilities set out for directors, industry specific regulations and special regulations for those owning and operating critical infrastructure.

Internal and external independent audits that provide an assessment of risk management controls and how they measure up against international standards and frameworks. Audits should cover all aspects of cyber resilience including:

• Identification of all cyber risks across the enterprise, emerging threats, catastrophic risks and those related to third parties.
• Current and robust cyber security strategy and controls for the current threats.
• Crisis Management Leadership, critical thinking and cyber security awareness.
• Organisational preparedness to respond to catastrophic cyber related risk.
• The effectiveness of the governance structure in building and maintaining cyber resilience capability.

• Utilising benchmarking or scorecards to provide assurance to key stakeholders by identifying gaps in capability that need immediate action and areas of excellence to be applied more broadly.