Improving data for managing cyber risk and building resilience

Bryson Alexander; Filippo Curti; Jeffrey Gerlach

Save this article

Need to know

Currently available cyber data is insufficient for effectively measuring and proactively managing cyber risk at the system level.
An examination of prominent cyber notification rules reveals that most do not require that covered firms provide critical details about cyberattacks and are inconsistent across jurisdictions.
A structured, horizontally consistent dataset, that captures detailed, nontechnical information on successful cyberattacks and near misses will provide the data needed for cyber risk management.
Implementing a harmonized regulatory reporting form to collect cyber data across jurisdictions will improve the quantification, pricing, and analysis of cyber risk, while reducing costs for the firms that provide the data.

Abstract

Gaps in the data available for assessing cyber risk have limited the development of metrics that would help the public and private sectors prevent and recover from cyber attacks and reduce systemic risk. Cyber incident disclosure rules, introduced to close the data gaps, help but fall short in supporting the effective management of cyber risk. This paper examines the current and proposed reporting requirements, especially in the financial sector, where they are the most prevalent. It describes the data gaps that remain and discusses how moving toward a better and harmonized cyber incident data collection rule could improve cybersecurity, reduce the risk of catastrophic cyber incidents and reduce the regulatory burden on companies that currently must report cyber data to multiple agencies.

As outlined in our terms and conditions, https://www.infopro-digital.com/terms-and-conditions/subscriptions/ (point 2.4), printing is limited to a single copy.

If you would like to purchase additional rights please email info@risk.net

You may share this content using our article tools. As outlined in our terms and conditions, https://www.infopro-digital.com/terms-and-conditions/subscriptions/ (clause 2.4), an Authorised User may only make one copy of the materials for their own personal use. You must also comply with the restrictions in clause 2.5.

If you would like to purchase additional rights please email info@risk.net