12th November 2018 – Responsibility for information security is not falling to any one senior executive function, according to the 2018 Risk:Value report from NTT Security, the specialised security company of NTT Group, which surveyed 1,800 senior decision makers from non-IT functions in global organisations.
At a global level, 22% of respondents believe the CIO is ‘ultimately responsible’ for managing security, compared to one in five (20%) for the CEO and 19% for the CISO. In the UK, fewer respondents point to the CIO (19%) and CISO (18%) while the CEO gets the biggest vote at 21%. The US (27%) and Norway (26%) buck the trend with more than a quarter of respondents suggesting the CEO is responsible, while in Singapore, one third say it is the role of the CISO – the highest figure across all 12 countries. Interestingly, around one in ten people in Switzerland believe the CFO is responsible for security.
“Responsibility for day-to-day security doesn’t seem to fall on any one particular person’s shoulders among our response base,” says Azeem Aleem, VP Consulting & UK&I Lead, NTT Security. “This narrow gap between the roles of CIO, CEO and CISO shows that no one executive function is stepping up to the plate. It could be a sign of unclear separation between the CIO and CISO though, as often they are the same or collaborate closely.
“On the other hand, should we be concerned that the CEO is not more involved in security matters, given the potentially damaging affects to the business, or should we be relieved that they are not managing a specialist task like this over and above other critical corporate responsibilities. The question is where do you draw the line?”
According to the 2018 Risk:Value report, although more people see the need for regular boardroom discussions about security, their organisations are failing to raise it sufficiently at the C-suite level. While 80% of all survey respondents agree that preventing a security attack should be a regular boardroom agenda item (up from 73% in last year’s report) only 61% say that it is, an increase of just 5% on last year.
Data security poor due to lack of cohesion at the top
NTT Security’s report also suggests that this lack of cohesion at the top of the organisation means that many are struggling to secure their most important digital assets. Fewer than half (48%) of respondents globally – 53% in the UK – say they have fully secured all of their critical data. But with the General Data Protection Regulation (GDPR) now fully in effect, this is no longer an opportunity, but mandatory.
However, companies are beginning to take control of their data as cloud computing best practices mature. Around a quarter (27%) report that the majority of their organisation’s data is currently stored on premise or in data centres (25%). However, in 12 months’ time, a similar proportion (25%) of respondents say that it will be stored in a cloud environment.
For further information on NTT Security’s 2018 Risk:Value report and to download a copy, visit: https://www.nttsecurity.com/en-uk/risk-value-2018
