This book will help you understand why organizations should treat enterprise cyber risk management (ECRM) as a value creator, a business enabler, and a source of competitive advantage. Organizations began to recognize the value of information and information technology in the mid-1980s. Forty years later, it is time to leverage ECRM programs and cybersecurity strategies in the same way.

The book builds the case for action, including how cybersecurity creates value and how courts, legislators, and regulators are raising expectations for C-suite executives and board members. It explains how a board’s three primary responsibilities—talent management, strategy, and risk management—intersect with its ECRM responsibilities.

ECRM once focused primarily on managing downside risk by defending organizations against adversarial, accidental, structural, and environmental threats. Author Bob Chaput argues that organizations must place equal emphasis on leveraging cyber strengths to increase customer trust and brand loyalty, strengthen social responsibility, drive revenue growth, lower the cost of capital, attract higher-quality investment, create competitive advantage, attract and retain talent, and facilitate mergers and acquisitions.

The first part focuses on the roles and responsibilities of the C-suite and board, the most important ECRM decision they must facilitate, and a different way to think about ECRM funding. You will learn how to pivot from cost-center thinking to value-center thinking. After building the case for action, the second part details the steps organizations must take to develop and document an ECRM program and cybersecurity strategy, beginning with the integration of ECRM into business strategy.