The boards and senior executives at many organizations are not adequately involved in enterprise privacy and security decisions, according to a report by Carnegie Mellon University's CyLab.

 

In the survey of 66 board members and senior executives at Fortune 100 companies, none of the respondents said that improving computer and data security is a top board priority, even though 56 percent said improving risk management is, according to the report. The finding suggests that there is a gap in understanding the relationship between IT risks and enterprise risk management.

 

The second annual "Governance of Enterprise Security" report also found that board participation on a number of IT security governance activities is worse than it has been in the past. For example, 61 percent of respondents said they have not reviewed or approved annual privacy and security risk management budgets – up from 40 percent who said the same in 2008, the last time the survey was conducted.

 

Respondents also are reviewing fewer security and privacy reports. Respondents also are receiving fewer security and privacy reports from senior management than the 2008 survey participants received. Meanwhile, 98 percent of respondents said their boards are not “actively addressing” vendor management, indicating that data residing with outsourced vendors is receiving little supervision. In addition, 65 percent of those polled said that their boards are not reviewing their company's insurance for cybersecurity risks.

 

Additionally, many firms lack key positions for privacy and security, according to the report: 53 percent of respondents said their organization does not have a CISO, while 62 percent do not have a CISO, and 80 percent have no CPO. And, a majority of boards have one committee tasked with both risk management and auditing, even though best practices and industry standards indicate that these functions should be separate, the report states. However, the percentage of respondents who said their board has separate audit and risk committees has risen from eight percent in 2008 to 14 percent in 2010.