Our hyper connected world poses a governance and oversight challenge for boards. Regardless of the industry or size, every organization is truly vulnerable to threats to its intellectual property and data. One misstep can cause untold costs from compromised data, loss of customer trust, diminished competitive position, fines, lawsuits and damaged reputation.

Recently, I moderated a panel for the National Association of Corporate Directors on this topic. NACD's “Public Company Governance Survey” reported that 87% of respondents felt that their board needed improvement in its knowledge of information technology, including security. Moreover, this disquiet extends to management. Deloitte recently surveyed 101 CFOs (most at companies with greater than $1 billion in revenues) and only 10% said they were well prepared for a major cybersecurity crisis, while almost 25% were insufficiently prepared.

Boards must effectively oversee and approve management of cybersecurity risk planning. They need current and complete information about the company's overall data protection program. Yet, a recent NACD survey found that only 12% of board members said they frequently receive briefings on cyber-threat mitigation. More than 60% of boards did not regularly receive such reports, and 26% rarely or never received them. These statistics do not reflect well on boards and their effective governance practices.