Skip to main content

When Leadership Says “Keep Us Safe”: Finding Cyber Risk Tolerance in the 10-K

 One of the most common questions cybersecurity professionals ask executive leadership is:

“What is the organization’s risk tolerance when it comes to cyber risk?”

And one of the most common answers they get back is:

“Keep us safe.”

“Don’t let a breach happen.”

While well-intended, these answers don’t actually define risk tolerance. No organization can be perfectly safe, and “no breaches ever” isn’t a strategy—it’s a hope. When leadership can’t (or won’t) clearly articulate cyber risk tolerance, you need to look elsewhere for clues.

One of the most useful—and often overlooked—places to find them is the company’s 10-K report.


Why Risk Tolerance Matters


Risk tolerance drives real decisions:

  • How much downtime is acceptable?
  • How much data exposure is tolerable?
  • How much money should be spent on security controls?
  • Which risks are accepted versus mitigated?

Without understanding leadership’s tolerance, security teams either over-invest (creating friction and wasted spend) or under-protect (creating unacceptable exposure).


The 10-K: Executive Risk Thinking, in Writing


A public company’s 10-K is an annual filing that details financial performance, business operations, and—most importantly for security leaders—risk factors. These disclosures are reviewed by legal teams and executive leadership, which means they reflect what leadership is willing to formally acknowledge as material risk.

When you read the 10-K, focus on:

  • Risk Factors section
  • Management’s Discussion and Analysis (MD&A)
  • Any section referencing cybersecurity, data breaches, operational disruption, or regulatory exposure

Pay attention to:

  • How strongly cyber risk is worded
  • Whether breaches or data loss are explicitly mentioned
Labels:

Comments

Post a Comment

Popular posts from this blog

Asset Management - Physical Devices - What do you have? Do you know?

Asset management and inventorying your physical systems, we all know we should do it, and I am sure most try.  I am not going to talk about the should have, would have or could have. Instead, I am going to focus on the risks associated with the NIST CSF control ID-AM.1.   The control simply states, “Physical devices and systems within the organization are inventoried.”  At the simplest level, this control is saying that the organization inventories all physical systems that are apart of the information system. In my opinion, the control is foundational because how can you secure something if you don't know it exists.  If you are not inventorying your systems, how do you know if they have adequate controls to protect the data and network.   If you had a breach of data, would you know what type of data was involved, or would you even know if you had a breach?  To further extend this, how can you perform a risk assessment on the system to understand and relay ...
Post a Comment
Read more

Vulnerability Management… It’s easy - Planning

I am sure you have had either consultants, vendors, or heard at a conference that vulnerability management is foundational security control.  While I agree that it is an essential control, I also understand that it is challenging to implement.  Vulnerability management is not just to pick a tool, scan, and fix issues.  Many components make it a complicated journey.  This series will attempt to help break it down and give you ideas on how this complex service and be delivered effectively.    Planning   Objective When you start, I recommend creating a targeted objective and set of measures against your objective.   Ensure that you keep in mind your organization’s culture, politics, and risk appetite as you are developing your objective.   I have seen some target just “critical” systems for regulatory compliance, whereas others have targeted their entire enterprise.   No matter your scope, keep in mind your team’s current resource...
Post a Comment
Read more

The Detect Function in NIST CSF 2.0: The Risk of Seeing Too Late—or Too Much

In NIST Cybersecurity Framework 2.0 (CSF 2.0) , the Detect function represents the organization’s ability to identify the occurrence of a cybersecurity event in a timely and reliable manner . While Protect focuses on reducing the likelihood of compromise, Detect determines how quickly and how accurately an organization recognizes that something has gone wrong. For CISOs and security leaders, detection is where many programs quietly fail. Not due to a lack of tools, but due to poor signal quality, unclear objectives, and misalignment with business impact. Detection that is late, noisy, or misunderstood can be as damaging as no detection at all. Official NIST CSF 2.0 guidance is available here: https://www.nist.gov/publications/nist-cybersecurity-framework-csf-20 What the Detect Function Is (and What It Enables) Under CSF 2.0, the Detect (DE) function focuses on outcomes related to: Continuous monitoring Anomalies and event detection Security logging and analysis Threat intelligence ...
Post a Comment
Read more