Given their roles as stewards of the organisation’s financial data (and much of its performance data), new and emerging security and privacy regulatory and disclosure mandates loom large for CFOs. Publicly listed companies have begun filing 10-K annual reports and 8-K cybersecurity incident reports in accordance with the amended Cybersecurity Disclosure Rule the U.S. Securities and Exchange Commission adopted last summer. In the European Union, the Network and Information Security Directive 2 expands the scope of the original directive to enhance cybersecurity across the entire European region by unifying national laws with common minimum requirements.

Complying with these rules requires a combination of expertise in regulatory compliance and reporting, risk management, cybersecurity, incident response, and data governance. CFOs are working closely with their information security counterparts while performing related activities to strengthen data security and privacy, including the following:

• Pursuing multilateral education: In addition to educating CIOs and information security leaders on materiality evaluations, board reporting on financial statement disclosures, and the organisational (and personal) risks of cybersecurity disclosure errors and misrepresentations, CFOs are learning about incident recovery costs, remediation efforts and the nature of compromised data from their CISO counterparts. And both CFOs and CIOs are educating boards of directors.
• Improving board reporting: CFOs need to ensure their boards have timely access to information concerning cybersecurity risks and capabilities by helping to define roles, responsibilities and collaborations among the disclosure committee, individual executives, financial and public reporting preparers, and other contributors to the disclosure process.
• Establishing and fortifying accountability: While backup signatures provide a “chain of certifications,” they may not provide assurance that reliable information is being furnished to management for timely disclosure. Instead, leading CFOs create a “chain of accountability” by linking required disclosures to internal reporting processes that deliver the necessary information in a timely manner to those making disclosure decisions.

Other work related to new disclosure and reporting requirements also reflects the CFO’s increasingly hands-on cybersecurity role. Finance leaders are developing new materiality frameworks for security and privacy breaches and monitoring how cybersecurity disclosures from other publicly listed companies are evolving (and, when called for, recalibrating their own disclosures to reflect leading practices).

Additionally, CFOs continue to collaborate with their board and C-suite colleagues to find new ways to strengthen the organisation’s overall cybersecurity processes as regulators, bad actors and investors intensify their scrutiny of this crucial capability.