Why cyber risk management matters for financial resilience

The growing cost of cybersecurity programs requires chief financial officers to integrate cyber risk management and financial oversight.

In brief

• Cybercrime can have serious financial consequences, and CFOs should take an active role in managing cyber risks in their organization.
• Working with other leaders can help CFOs understand the organization’s potential exposure and make better financial decisions related to cybersecurity risk.
• By including the finance function in cyber risk management, CFOs can help protect the company’s assets, comply with regulations and avoid financial losses.

Cybersecurity is not just an IT problem or a crisis scenario from a playbook, but a persistent and growing business concern with real financial implications, including the potential costs of incident response, legal liabilities, reputational damage, and loss of revenue from lack of consumer trust.

In 2023, the average cost of a data breach for businesses based in the United States exceeded $9 million per incident.¹ With schemes including extortion, social engineering and phishing attacks combined with vulnerabilities due to organizations’ increasing reliance on third parties, the likelihood of a damaging cyber incident continues to escalate. Cybercrime caused $12.5 billion in financial damage in the United States in 2023, a 22% increase year over year, according to FBI statistics.²

2. Cyber due diligence during mergers and acquisitions (M&A)

M&A activities present unique cybersecurity challenges that can lead to unexpected losses. There are several notable examples of where post-deal cyber incidents or data breaches were discovered, resulting in additional costs being incurred by the acquiring company.

As part of the due diligence process, the CFO should work with the CISO to understand the cyber health of a potential acquisition. This helps to prevent the acquirer from inheriting vulnerable systems or latent threats, identify potential integration costs, avoid unforeseen liabilities and facilitate smoother post-merger integrations.

Questions to consider:

• What is the cybersecurity program maturity level of our target company?
• How can these risks be mitigated, and how can we protect the company financially and operationally while we integrate? 
• Are there new regulations that will need to be complied with due to acquiring the target company?
• Can cybersecurity tools and platforms be consolidated to reduce costs and enhance security measures through shared leading practices?
• Are there any deal terms that should be adjusted based on cybersecurity risks and vulnerabilities?
• Are we prepared to protect our assets pre- and post-transaction?

4. Financial reporting and disclosures

More than half of boards meet with cybersecurity management at least annually, and in about 80% of the Fortune 100 organizations we studied, cyber risk oversight falls to the audit committee.

Cyber risks related to technology adoption can have significant implications for financial reporting, including the external audit of a company’s financial statements and internal controls over financial reporting. Cybersecurity incidents can also disrupt financial reporting processes, potentially delaying the timely production of financial statements and impacting regulatory compliance.

CFOs should consider advocating for the inclusion of cybersecurity controls within the overall risk assessment and internal control framework to identify gaps and risks that could impact the company’s cyber risk profile. In addition, CFOs should confirm that the company’s 10-K filing accurately reflects its cyber risk management, strategy and governance.

The Securities and Exchange Commission (SEC) cyber disclosures rules require publicly traded companies to disclose a material cybersecurity incident to shareholders and the SEC within four business days of determining it is material by filing Form 8-K. In making the report, the CFO should ensure that the disclosure is accurate, complete, and filed on time.

Collaborating across functions, including the legal and compliance teams as well as with the CISO, becomes critical so that disclosures are informed by the latest cybersecurity risk management practices. We have found that practicing responses to simulated incidents, particularly those that would be determined to be material, is an effective way for CFOs to understand their organization’s level of preparedness and agility during a real-world event, and an important method in testing disclosure processes.

Questions to consider:

• What are the disclosure obligations in relation to cybersecurity risks and incidents and how do they impact the company’s disclosures and financial reporting obligations?
• What are the financial implications of noncompliance?
• How should we balance transparency with the need to protect sensitive information during a cybersecurity incident investigation?
• Do our internal controls adequately address cybersecurity risks?
• How do changes in cybersecurity regulations affect our financial reporting and audit processes?
• How would a cybersecurity incident impact our financial statements?

Clear and accurate disclosures can enhance investor trust and prevent regulatory penalties, positioning the CFO as an increasingly important stakeholder in the organization’s cybersecurity preparedness. By providing oversight and direction on the organization’s cybersecurity risk management program and reinforcing this tone from the top across the business, the CFO can sponsor a cyber strategy that enables the organization to navigate cyber complexities with confidence.