Boards should have sufficient cyber security expertise, and discussions about cyber risk management should be given regular and adequate time on the boardroom agenda;

Directors should set the expectation that management will establish a firm wide cyber risk management framework that has adequate scope for staffing and budget;

Discussions of cyber risk should include identification of which risks to avoid, accept, mitigate, or transfer, as well as specific plans associated with each approach.

Marshall added: “Following a number of high profile breaches, we are seeing global investors waking up to the issue of cyber security.  The ripple effect of this has seen investor appetite for cyber businesses increase, with the survey revealing that 86% of investors see it as a growth area.

“There is an expectation from investors for businesses to increase their cyber capabilities from top to bottom, including the board.  In a world where breaches are common, is reasonable to expect boards to have prepared themselves.  My personal experience of working with organisations that have been breached is that businesses that are generally well run and understand risk, are better prepared for future risks.  A serious breach brings the competence and teamwork of senior executives and the board into sharp focus.  What we are seeing is companies struggling to demonstrate that they are taking cyber risk seriously to their existing and potential investor base. The inability to demonstrate that a business is doing so could make it a less attractive investment proposition.

“A good start would be for boards to elevate cyber higher up on the agenda and invest more time towards it.  Our survey reveals that 86% of investors want to see an increase on the time boards spend on cyber compared to last year.”