Cybersecurity Reporting Best Practices

Today, businesses are at an interesting intersection when it comes to cybersecurity reporting: with modern technology, tons of data and thousands upon thousands of metrics are available to report on — but it’s difficult to determine which cybersecurity metrics actually matter. Because of this conundrum, many security and risk professionals feel a level of confusion around their security posture (and the security posture of their third party vendors). Does this sound familiar?

Fortunately, this uncertainty can be avoided simply by using the right reporting tools and considering the audience you’re reporting to. Below, we’ll walk through three simple but critical cybersecurity reporting methods you should start using immediately.

3 Crucial Cybersecurity Reporting Methods To Begin Using Today

1. Adding business context to your metrics.

Being able to highlight impact and business value of security is a critical step security and risk professionals need to take. For example, Bitsight recently added Vendor Action Plan capabilities which provide actionable guidance within the Security Ratings platform. This means your vendors are grouped in three separate categories — “Escalate,” “Review,” and “Monitor” — which will help you determine the next steps to properly monitor and collaborate with your third parties.

This is a crucial cybersecurity reporting requirement, because when you report to the Board, you need to provide some level of context about vendor risk management. Using the Vendor Action Plan, you could easily tell your board that only 2% of your vendors are in the Escalate category — but since companies with a rating of 500 or lower are almost five times as likely to experience a breach, you can recommend a specific and immediate course of action to remediate these vendors’ ratings. This is powerful, relatable, and helps tell a better story with your data.

2. Tiering your vendors for more efficient monitoring.

Many organizations have suffered a major breach because they ignored a “non-critical” vendor that actually had great deal more network access than anyone realized — which was either taken advantage of by the third party or by a hacker who exploited the opening.

One way you can proactively work to prevent such an issue is by tiering your vendors:

1. Tier 1 vendors are the most critical to your operations and have the highest levels of access to your data.
2. Tier 2 vendors are less critical to your operations but should still be monitored consistently and regularly.
3. Tier 3 vendors don’t have access to sensitive information and are not critical to your operations, but they are still part of your vendor mix.

Companies are taking different approaches to these tiers. For instance, your company may only use security ratings to assess the security risk of your Tier 3 vendors, but you may have a much more rigorous and thorough vendor assessment process that combines traditional questionnaires and penetration tests with security ratings for your Tier 1 and 2 vendors. Whatever the case may be, tiering your vendors is a great way to design and execute proper monitoring programs aligned with risk.

3. Leveraging your reporting capabilities to enable more effective security conversations and programs across your organization.

Board rooms aren’t the only place cybersecurity reporting conversations are taking place; they’re likely also happening in other meetings like department reviews or quarterly business reviews. More groups want to be able to share and understand how they and their vendors are performing. In fact, if you’re using a tool like Bitsight Security Ratings, you could set up an interdepartmental competition. For example, the U.S. branch of your company may have an aggregate vendor rating of 650, and the U.K. division may be at 700. By posing this kind of metric as a challenge, both parties may enjoy this “competition” more as they work toward better cybersecurity postures.

If you don’t have multiple branches that could “compete”, there are still plenty of ways to leverage your reporting tool for better cybersecurity actions. For example, if you know of a cybersecurity vulnerability that preys on a particularly vulnerable open port, you can determine which of your vendors have that port open so you can take immediate remediation steps to close it.

Remember: Cybersecurity reporting requirements depend on the individual requesting the information.

Consider who is looking for a cybersecurity report and what information they’re interested in before you decide how to report. You’re no longer reporting cybersecurity only to your boss — you’re also reporting to the Board of Directors, regulators, external stakeholders and customers, and possibly even cyber insurance providers. Taking a risk-based approach to cybersecurity reporting is vital to help you communicate risk in the best way, for the best audience.