Cybersecurity as a leadership responsibility

Knowing what the work depends on

One question helps bring security into management: which activities would struggle to continue if certain information or systems became unavailable? The answer concerns everyday work, people, commitments to customers and relationships with suppliers.

As CEO and cofounder of Datasec, I consider this connection essential in conversations with organizational leaders. Management needs to be able to understand which dependencies deserve attention and what operational consequences a disruption could have. This requires translating technical input into information that can be used in decisions.

A map of critical activities helps us ask concrete questions and set priorities for further investigation. External dependencies also need to be visible: a service used every day effectively becomes part of how the business operates.

Assigning clear responsibilities

Specialists are essential. Their work, however, requires an organizational setting that can make decisions, allocate resources and follow through on agreed actions. Who assesses priorities? Who authorizes a change? Who coordinates functions when a problem arises? What information needs to reach management?

These questions concern business governance. A vaguely worded responsibility can leave room for interpretation precisely when greater clarity is needed. It is useful to check that everyone understands their role and knows whom to turn to.

The relationship with those carrying out everyday activities also deserves attention. Procedures that are difficult to understand or apply need to be discussed. People can flag points of friction and situations requiring specialist assessment. Encouraging them to do so makes organizational decisions better informed.

Preparing for discussion before an emergency

Preparation includes the opportunity to discuss scenarios, check the steps in decision making and identify the information needed during a disruption. These activities should be defined with the appropriate technical expertise and in relation to the organization’s characteristics.

From a leadership perspective, what matters most is bringing dependencies and unresolved choices to light. A procedure gains value when those who need to apply it understand its purpose and can discuss the obstacles.

Cybersecurity thus becomes part of ongoing management. It becomes an issue to monitor over time, with defined responsibilities and regular dialogue between management, operational functions and specialists. Leading also means establishing this dialogue and making informed decisions about the problems it reveals.