Survey results indicated that our respondents have a moderate awareness of cyber security risk, but in our opinion, this awareness is insufficient: firstly cyber security risk appears to be underrated by Namibian boards and secondly there is a knowledge deficiency regarding the intricacies of cyber security risk, a trend that is replicated in the  Deloitte CFO survey 2018/2019 , where only 44% respondents considered cyber-crime a threat to their organisation. This is in sharp contrast to the results of the aforementioned Checkpoint research which clearly indicates that cyber security risk is woefully underrated, and a significant threat to organisations.

What level of awareness does the board have on cyber security risk?Ineffective Governance

The main risk areas that the respondents of our CFO survey are concerned about include corruption (74%), fraud (65%), cyber-crime (44%) and staff theft (38%). This, however, does not take into consideration the evolution of crime over the past decade. In the current environment, the majority of operations are performed via electronic means and therefore, crime has likewise evolved to take advantage of those same channels. Consequently, the impact of cyber-crime is neglected disproportionately in light of potential risks and should, we believe, be of a much larger concern for executives in Namibia.

40% of respondents indicated that they do not have a separate cyber security strategy as it is encompassed in the comprehensive risk plan, with the Chief Information Officer (CIO) or Chief Technology Officer (CTO) taking ownership of cyber security. The survey also found that managing cyber security risk is perceived to be the responsibility of IT, with limited ownership lying with the business as a whole. However, we believe that, to the high potential impact of cyber security breaches on the business, this is no longer sufficient and responsibility for the management of cyber security risk should increasingly be a main strategic concern overseen by the CEO and Board on a frequent basis. A key point to realise is that business owns the information that is targeted, exposed, corrupted and/or rendered unavailable, making cyber security a business issue.

Most worrisome to us is that, 14% of respondents do not consider a cyber incident likely or cyber security risk to be a priority. This indicates a potentially disastrous weakness for those companies, their customers, suppliers and staff. In our interconnected world, a single point of weakness could bring down the entire network of relationships and thus cyber security and information security become a pervasive issue to consider at all levels of interaction.

Does the entity have a separate cyber security plan in place?

Once an organisation has established the need to address cyber security risk as a key strategic concern, there are several considerations that should be made to develop the correct strategy for the individual entity, which includes:

1. Establish a risk-based IT governance strategy, taking into consideration various aspects, such as:
         -The likelihood of threats based on situational awareness, 
         -Incident history in own organisation, industry and country as well as threat intelligence;
   
   
2.  With reference to best practice standards such as ITIL (etc.), developing a dedicated cyber security strategy and assigning
   responsibility at the correct levels (i.e. a joint responsibility between the
   CIO and/or CTO and CEO/COO, with oversight by the Board periodically); and
   
   
3. Upskilling responsible individuals, especially at the Board level.

Namibian entities are urged to employ governance guidelines as outlined in chapter 5 of the Namcode
(Namibian Code for corporate governance), as follows:

1.    The board should be responsible for information technology (IT) governance; 

2.    IT should be aligned with the performance and sustainability objectives of the company;

3.    The board should delegate to management the responsibility for the implementation of an IT governance framework; 

4.    The board should monitor and evaluate significant IT investments and expenditure; 

5.    IT should form an integral part of the company’s risk management; 

6.    The board should ensure that information assets are managed effectively; and

7.    A risk committee and audit committee should assist the board in carrying out its IT responsibilities.

Namibia Code Code for Corporate Governance, Chapter 5

These guidelines can be tailored to each entity’s individual strategy with reference to international best practice standards such as NIST, COBIT, ITIL and ISO and implementation plans can be phased in incrementally, enabling even small companies to make drastic strategic improvements to their cyber security in a short period of time and closing critical gaps.