3. Enterprise Risk Management and Cybersecurity Governance

This chapter covers the design and implementation of the different forms and processes of cyber risk governance within the Enterprise Risk Management (ERM) framework. We discuss the cruciality of ERM as the foundation for a holistic and integrated risk control mechanism for enterprise cybersecurity governance. We also discuss the need for and implications of governance as a policy tool within the ERM context in strategic cybersecurity planning, risk assessments, security controls, incident response, business continuity, and compliance with legislation and standards. The three basic categories of cybersecurity risks are distinguished, i.e., national security, industrial espionage, and cybercrime. By separating the connotations of cybersecurity and analyzing the various actors and the related governance frameworks, we help create a better understanding of cybersecurity. Another aspect investigated is the difference between strategic and tactical cyber risk management as they pertain to two hierarchical levels of authority, oversight and responsibilities. This dissected approach allows the organization to appreciate the cyber threats it faces and be able to design the appropriate cybersecurity governance measures within the ERM architecture, policies, and procedures to tackle them. A holistic and integrated governance approach is adopted to plan, design, and incorporate cyber risk control measures into the ERM framework for execution from a strategic and tactical perspective.