It is high time for business leaders to realise that cyber security is no longer a task that can be delegated to the IT department. It is the management's responsibility to develop strategies and establish a corporate culture that prioritises cyber security
Af CBS Leadership CentrePhoto by Franck on Unsplash
Once a month, researchers from CBS write a column in Børsen, where they give readers a current and research-based perspective on the challenges leaders face.
In this column, Jan Lemnitzer, Assistant Professor at the Department of Digitalisation, and Johann Ole Willers, post.doc. at the Department of Organisation, focus on how cyber security is a leadership task that goes across the organisation and involves many other parts of the organisation, beyond 'just' the IT department.
Most leaders will have heard about the upcoming EU legal requirements in cyber security, but many mistakenly believe that these only concern the 1,400 Danish companies that fall directly under the scope of the EU directive. This view is a dangerous underestimation of the situation that is fast approaching.
The upcoming NIS2 directive, which will enter into force in October 2024, contains an overlooked but crucial clause that will create a wave of change across sectors and company sizes. The board's responsibility for cyber security now also includes risk management in the supply chain.
Creation of new challenges
The consequence is that all critical infrastructure companies will take a close look at their supplier's security measures and demand extensive documentation for these. This creates a number of new challenges – but also opportunities.
The need for robust cyber security measures is of course not new. All leaders, regardless of industry and company size, have had to deal with the rapidly increasing number of hacker attacks – often in the form of ransomware. But in the new situation, what was a risk management problem now also becomes a compliance problem: suppliers who cannot document satisfactory cyber risk management will lose customers and business opportunities. Therefore, it is no longer a question of whether strengthened cyber security can be a competitive parameter. It is a fact.
Cyber security is not only the IT department's problem.
Leaders are thus now faced with an important task: to understand the new demands and act accordingly, and the starting point for this task is the recognition of three fundamental truths.
1. Cyber security is a leadership responsibility that cannot be delegated to the IT department. Cyber security must be understood as a strategic investment area that affects the entire company. The leadership is tasked with both developing strategies and creating a corresponding corporate culture.
2. This cannot be postponed. There is a real risk of repeating the chaos of the weeks before GDPR came into force in May 2018. Businesses need to demonstrate to their customers that they are a responsible member of their supply chains, and this is a time-consuming process that requires a whole new overview of the company's organisational structure. This implies that management obtains a detailed overview of their IT infrastructure, who has access to which network and how corresponding risks are monitored and mitigated.
3. Cyber security is very much a supply chain issue, and this truth applies to both critical and non-critical companies. Leaders must therefore take a close look at their own suppliers, especially those with direct access to their network or data. The ransomware attack against the hosting provider AzeroCloud is one among many examples that show how insufficient cyber security measures among suppliers can be life-threatening for companies, especially SMEs like in this case Chili Klaus.
What then needs to be done? The biggest challenge is to upgrade cyber security on often quite limited budgets. It requires smart decisions and prioritisation. Leaders must therefore acquire a minimum understanding of cyber security. The board association's establishment of a center for cyber competences is an important step on the way and can become a valuable resource for leaders.
Need for guidelines
However, it remains a major problem that existing cybersecurity standards and guidelines are typically targeted at large enterprises, which do not reflect the realities of SMEs. It is thus not surprising that a study by Aalborg University's Torben Elgaard Jensen and Laura Kocksch shows that SMEs' approach to cyber security is often characterised by pragmatism, lack of knowledge and patchwork solutions.
Few Danish companies have the resources to make use of existing certifications, and there is an urgent need for guidelines that target the reality of SMEs. This is the gap that we, at CBS, want to remedy with our new project 'Cyber security in supply chains', which is financed with the support of Industriens Fond.
Strengthened cyber security is a competitive parameter, and the new EU rules emphasise the need for increased efforts in this area. Whether companies can deliver and strengthen competitiveness by being responsible parts of the supply chain will depend on whether leaders across society are ready to meet the challenge. There is only one year left.
CBS Leadership centre is connecting researchers and leaders around a shared ambition: to enable professionals to successfully assume their leadership and create value and resilience in businesses and organisations –and bring on necessary transformation fueled by significant societal agendas such as green transition, diversity, digitalisation, innovation and ethics.
Did you find this content interesting? Sign up for our newsletter and gain access to more of our research findings and events.
With the world’s grand challenges awaiting us, we need to continuously evolve, gain new knowledge and insights, and upskill.
Dive into a world of knowledge by signing up below. You will get:
Where managers and experts meet to develop themselves and their organisations.
This HD course addresses how companies' various stakeholders, e.g. management, staff, the business and business partners can become better at working together on strategic plans and implementation. This course is offered in Danish 🇩🇰
