What is board cybersecurity oversight? How directors supervise cyber risk, defined

Board cybersecurity oversight is the board of directors' supervision of how management identifies, manages and reports cybersecurity risk, carried out by the full board or delegated to a committee such as audit or risk. It covers who briefs directors, on what and how often, and whether resources match the risk. US public companies must describe it every year under SEC Item 106.

What the rules require

The SEC's Item 106(c)(1) requires a public company to describe the board's oversight of cybersecurity risk, identify any committee responsible, and explain how the board or committee is informed.

New York's Part 500 goes further for financial firms. Since its second amendment took effect on 1 November 2023, with a year to comply, the board or equivalent body must understand cybersecurity well enough to oversee it, which may include using advisors. It must also require management to run the program, regularly receive management reports, and confirm that management has allocated sufficient resources.

The NIST Cybersecurity Framework 2.0 frames the same duty as governance outcomes: organizational leadership is responsible and accountable for cybersecurity risk, and oversight results are used to adjust the risk strategy.

Expertise and frequency: what the SEC left out

In its final rule of 26 July 2023, the SEC declined to require disclosure of directors' cybersecurity expertise, reasoning that "directors with broad-based skills in risk management and strategy often effectively oversee management's efforts without specific subject matter expertise." It also dropped a proposed requirement to disclose how often the board discusses cybersecurity, while noting that a company relying on periodic CISO presentations may mention their frequency.

How filings describe it

Structures differ. HubSpot's 10-K for 2023 keeps final oversight at the full board, gives the audit committee the review role, and says the full board meets management on cybersecurity typically twice a year. F5's 10-K for fiscal 2024 assigns the work to a risk committee that meets at least four times a year and reports to the full board.

What it is not

Oversight is not management. Part 500 has the board require executive management to develop, implement and maintain the program, and the SEC's release described effective cybersecurity processes as designed and administered largely at the management level. The board asks, tests and resources; the CISO and management run the program and report on it.

Where it appears on CISO Tribune

• Board committee oversight report: the committee each company's own proxy statement names as overseeing, or receiving reports from, its CISO or CSO.
• Item 1C disclosures: searchable by committee.
• What boards want from CISO presentations: the briefing side of oversight.

Related terms

• Regulation S-K Item 106
• CISO reporting line
• Cybersecurity materiality