This recent post from Audit Analytics: "Cybersecurity Experts on the Board of Directors" compares on an industry-by-industry basis the prevalence of cyber breaches to the number of directors appointed with cyber expertise, and (inappropriately) concludes - based on the absence of congruency between the two - that certain industry boards are laggards as respects their cybersecurity oversight responsibilities. In other words, the post appears to equate effective board cybersecurity oversight with boards appointing cyber-expert directors.
While appointing a director with cyber expertise may make sense for some companies and there is no reason to dispute the post's assertions regarding the cyber-related cost savings associated with board-level involvement, cyber-expert directors are by no means a panacea or warranted for most companies - nor should they be used as a proxy by investors or other for effective board oversight.
Rather, each board needs to determine and periodically re-evaluate how to optimally effect its risk (including cyber, among many others) oversight responsibilities considering the nature of the company's industry, business and associated risks; board composition and committee structure; qualifications and depth of the company's management and other internal resources, and organizational/reporting structure; availability of external resources; and other relevant factors. The fact is that there are numerous ways to effect adequate and proper involvement and oversight that don't entail appointing a cyber-expert director - as is the case with numerous other risks and corporate functions and operations that boards are charged with overseeing.
This excerpt from Deloitte's recently-reported interview with experienced director Richard Lenny (non-executive board chair of Information Resources Inc., and a member of the boards of McDonald’s, Discover, Conagra, and Illinois Tool Works Inc.) is worth noting:
[T]here’s a risk when boards recruit someone who excels in a particular area just to fill a gap. When this topic comes up, all eyes turn to the expert, but when any other topic comes up, all eyes turn away from that person.
What’s far more important when building a board is creating the right dynamic and the ability of the directors to work well together, particularly in challenging times. The board needs to represent a great diversity of thought, be able to disagree without being disagreeable and have the appropriate balance of skills and capabilities to address all of the issues with which it contends.