Cyber Crossroads: A Global Research Collaborative on Cyber Risk Governance

TL;DR

This paper discusses the formation of Cyber Crossroads, a global collaborative effort to develop a practical, governance-based Cyber Standard of Care that addresses increasing cyber risks without relying on commercial products.

Contribution

It introduces a novel, non-profit, collaborative framework for a universal Cyber Standard of Care integrating technology, legal, and risk perspectives across industries and organization sizes.

Findings

Engaged with 56 organizations worldwide to identify best practices.

Developed a governance framework that is practical and adaptable.

Secured guidance from regulators and legal experts across jurisdictions.

Abstract

Spending on cybersecurity products and services is expected to top 123 billion U.S. dollars for 2020, more than double the 55 billion U.S. dollars spent in 2011.1 In that same period, cyber breaches quadrupled. Organizations globally face increasing liabilities, while boards of directors grapple with a seemingly Sisyphean challenge. Cyber Crossroads was born out of these alarming trends and a realization that the world cannot go on funneling finite resources into an indefinite, intractable problem. Cyber Crossroads brings together expertise from across the world, spanning aspects of the cyber problem (including technology, legal, risk, and economic) with the goal of creating a Cyber Standard of Care built through a global, not-for-profit research collaborative with no commercial interests. A Cyber Standard of Care should be applicable across industries and regardless of the organization size. It should be practical and implementable, with no requirement to purchase any product/service. Cyber Standard of Care should be woven into the existing governance fabric of the organization and it should not be yet another technical checklist, but a process/governance framework that can stand over time. To achieve this, we engaged with cyber risk experts and practitioners with a variety of relevant expertise, secured the advice/guidance of regulators and legal experts across jurisdictions, and interviewed leaders from 56 organizations globally to understand their challenges and identify best practices.