Officers (CEOs), Board Chairs, their Chief Information Security Officers (CISOs), as well as other Board Directors, C-Suite Executives and their Investors, the CEO-driven yet decentralized, Board-down method for breach prevention, getting all Board Directors and C-Suite Executives cyber-ready to execute their part and creating a culture of cyber security from the Board down, thus also helping organizations alleviate the pressure on CISOs as the focal point of creating and sustaining cultures of cyber security and serving as an indispensable complement to CISOs’ work of cyber- securing the information technology (IT) and operational technology (OT) infrastructure of organizations.
This method, called The CEO Method™, was invented by global tech and defense investment banker, entrepreneur, US Congressional adviser, Wharton and Harvard alum Andrzej Cetnarski, Chairman, CEO and Founder of Cyber Nation Central®, global cyber security protocol education, insights and advisory company dedicated to helping clients achieve cyber-secure-by-design boards, executive teams and organizations. Cetnarski invented The CEO Method™ and its protocol process in response to a fatal breach of his first venture, where even the most cyber-secure technology and best-performing CTO were not able to prevent a breach caused by lack of understanding by the Board, C-Suite and blue-chip investors of what a true culture of cyber security entailed, allowing the threat actors to take advantage of the still-very- typical-of-Boards-and-investors-today gap in cyber security knowledge and awareness, further exacerbated by a still-CISO-centric approach to cyber security.
In so doing, this paper also teaches its readers the process for bridging the widening gap between CISO, regulatory compliance and technology as ‘the answer’ versus actual hacker-deterrent cultures of decentralized cyber security, individual ownership of cyber-specific fiduciary roles and tactical responsibilities, ‘partnership with’ instead of ‘over-reliance on’ the CISO and mastery of individual risk and response, individual cyber security and organizational cyber-strategy and each Board Director’s and Executive’s role in it.
Part I of the paper focuses on the "Boards & C-Suites' Chessboard and Roles" and covers the answers to:
‘Why and how should CEOs, board chairs and CISOs treat breach prevention readiness differently than they are now?’,
‘Why and how is the core concept of cyber security different than what most boards and C-suites think it Is?’ and
‘What do boards and C-suites need to be doing differently to close the gap between the 37.5% chance of breach and US$10mm average cost of breach and actual breach deterrence?’
Part 2 of the paper focuses on "The Culture Transformation Process" and covers the three-part, six-step Process for Achieving a Culture of Cyber Security from the Board Down, including a comparison between the market’s current Chief Information Security Officer (CISO)-centric approach versus The CEO Method™, as well as results to be expected from both approaches. By the end of Part 2, readers will have learned what ingredients CEOs, board chairs, directors and non-CISO executives need to be deploying in their own cyber roles to build a culture of cyber security from the Board down, and do so in a way that critically complements (but does not replace) what the CISO is doing, thus providing organizations with an actual chance of preventing a breach.
KEYWORDS: breach prevention, cyber acuity North Star, culture of cyber security, CISO- centric approach, CEO method, hacker-deterrent cultures, decentralized cyber security