Over the past year, the rules set by the U.S. Securities and Exchange Commission (SEC) for 

 have become a standard requirement for public companies. These rules aim to keep investors better informed about a company's risk management, strategy and governance, ensuring timely notification of any incidents considered material to the business. The rules require the following:

A written description of an organization’s processes for identifying and managing material risks from cybersecurity threats.

Notification within four days of cybersecurity incidents deemed to be material, either individually or in combination with other similar incidents.

Public filings and other reporting on management’s efforts to implement security procedures and serve in an oversight role.

With these requirements in place, it is crucial for companies to quickly transform cyber preparations into actionable strategies and for boards to enhance their disclosure and oversight responsibilities.

The SEC’s final rules went into effect mid-December 2023 following publication in the Federal Register. In the meantime, what actions do boards need to take today, as well as further down the road? How can directors increase their cyber-savviness, and what do they need to know for the future?

“Boards, CEOs, and CFOs want to be looking at these disclosures to make certain that they’re accurate and there’s operating processes in place that are really effective around these risk management areas,” Barbara Berlin, managing director of PwC’s Governance Insights Center, said in an episode of 

Under the rules, disclosures fall into the following buckets: cybersecurity incidents/overall strategy, risk management and governance. The latter covers many things: risk assessment processes, how the company manages risk by detecting threats and protecting information, business continuity and recovery plans — the list goes on.

Not only will directors need to get used to a new level of disclosure, but they will also need to accustom themselves to new processes. For starters, disclosures on strategy, risk management and governance will now be part of a 10K, rather than the proxy statement as many people expected, Berlin said. “I think this is a pretty significant change,” she said.

Another big change: Disclosing cyber incidents in an 8K, which Berlin estimates only 20% of companies do right now.

Bringing in outside experts for board briefings

Requiring outside cybersecurity courses and credentials for directors

Examining the existing knowledge base — is there a cyber expert on the board already, and what are their credentials and expertise?

Finally, all directors should have a macro view of the organization’s cyber programs through assessments and frequent communications with top technology leaders. This is necessary for both overseeing cyber risk and considering these risks in business strategy, financial planning and capital allocation processes. For example, does the organization have adequate insurance and planning in the event of a cyber breach? Is the company modeling the range of financial impacts?

Myrna Soto, CEO and founder of Apogee Executive Advisors, emphasized the governance, risk and compliance (GRC) connection at Diligent’s 2022 Modern Governance Summit — the need to understand what’s being disclosed and the “so what?” from a business standpoint.

“Putting it into business terms works magic in the organization,” she said. “Because when you can contextualize it, now you have to go to a line leader or technology leader and say hey, I really need you to work with me on this project and I need you to give me visibility into what you’re doing.”

On the management side, what do chief technology, information security and information officers need to know about the SEC regulations? What must they do to ensure compliance? How can they set themselves up for success in the future?

First of all, given the compressed timeline for disclosing material cyber incidents, CTOs, CISOs, and CIOs need to make sure cyber reporting is plugged into controls and procedures for disclosures, and ensure clarity in terms of elevating cyber incidents. When does an incident qualify for board notification, and who does the notifying?

Does the company have a top leadership role like a Chief Information Security Officer? What are their credentials? Who does this person report to — and is this reporting independent of the overall IT organization, similar to how internal audit typically doesn’t report within an organization’s overall finance operations?

, managing director and founder of AllegisCyber Capital, presents a case for making cyber risk part of the auditing process. “The annual audit is based on an understanding of the company’s business, its risks and its controls to mitigate those risks. It’s a simple, logical conclusion that cyber risk — when measured objectively and with scientific rigor — should be included as part of how the industry and regulators measure and analyze systemic risk for every company.”

Finally, CTOs, CISO, and CIOs must do their part in ensuring — and documenting — a comprehensive cybersecurity program. Some next steps to ensure the necessary nuts and bolts include:

Administering cyber training for all employees

Evaluating systems through a third-party cyber penetration testing firm, or white and gray hat cyber exercises

Upgrading security and backup systems as needed

Supplementing internal cyber monitoring efforts with those of an externally managed services provider

Continuously monitoring cyber activity in real time and measuring this activity against security tools and controls

“Measuring the effectiveness of a cybersecurity program is still a rather new concept. But cybersecurity isn’t unknowable,” says 

. “Its complexity doesn’t exempt it from measurement. Today there are many more tools and processes to continuously monitor and measure controls compared to just a few years ago.”

 prepare your board for enhanced cybersecurity disclosures.

Transform cyber risk into a strategic advantage

Whether you're on the board, an executive or a risk practitioner get ready to learn powerful strategies for aligning cybersecurity priorities with business goals, enhancing risk reporting and building stronger board engagement in cyber risk management. Sign up for our 

Secure your spot today and join us in steering the future of cybersecurity across the globe.

Register for the EUROPE, MIDDLE EAST and AFRICA event 

SEC cyber rules: Essential knowledge for boards and executives

What is meant by strategic risk? Strategic risk examples encompass many different risks — and depending on the nature of your business, you may face any or all of them. Understanding the types of strategic risk you face is fundamental to your ability to tackle them as part of your broader 

Whether you are a chief risk officer and strategic risk falls firmly within your orbit, or whether as CFO, CEO or general counsel, you take more holistic responsibility for your organization's risk strategy. Understanding and mitigating risk at a strategic level will be a priority.

In today's hyper-connected world, the risk evolves faster than businesses can devise strategies to tackle it. Being familiar with different strategic risk examples can help you get ahead of the curve, helping you identify the types of strategic risk your organization faces and the tactics you can put in place to respond.

Understanding the different types of strategic risk

'Strategic risk' is a term that's often bandied about. But what does the phrase mean in practice? What types of risk are defined as 'strategic?' How do you identify strategic risks? What are the examples of strategic risks you might face in your organization? What are the types of strategic risk you should prioritize in your risk mitigation strategy?

Strategic risk is a category of risk; alongside operational, financial, regulatory and other business risks, it forms part of the umbrella of risks your organization faces.

When we look at strategic risk examples, they are generally defined as those that threaten a business's ability to set and implement its chosen strategy.

They may be 'self-inflicted,' brought about via an organization's own strategy and decision-making. An example of this would be the 

 of businesses, which has delivered many positives but has also exposed new types of risk.

Regulatory and legislative drivers relating to governance, risk and compliance strategies more generally are also prompting businesses to focus on strategic risk. At the same time, a spotlight has been thrown on strategic risk via growing awareness of the 

close ties between risk, compliance and business value

This evolution of risk has led organizations to try and bring some structure to their mitigation strategies by categorizing and prioritizing the risks they face. Let's look at some of the examples of strategic risks you might face.

Some sources distill strategic risks into five types, sometimes called the 'five sources of strategic risk.' However, look up several different sources, and you will find a variety of risks listed among the 'five types.'

Our list of strategic risk examples below includes more than the standard five.

What are the 9 examples of strategic risk?

Among the types of strategic risk you should have on your radar are:

 as they innovate and improve their offerings faster than you.

 we cited above is a prime example of this ' the inherent risks of introducing any change program.

 Regulatory risk is any new regulation has the potential to:

Demand new technologies (and therefore linking back to change risk)

Distract your business leaders from their operations as their time is abstracted to put in place new governance processes and control measures

Learn more about today's most pressing regulatory risks by downloading the latest edition of our 

 The risk that your corporate standing is threatened. The potential causes of this are legion, from 

 breaches to shareholder activism or poor performance in public ratings, such as those used to measure 

 The potential for political change, or the political landscape overall, to disrupt your business. For example, through volatility in a country within your 

 Risks relating to the financial health of the organization. This differs from...

 This refers to the broader economic landscape and its potential to affect the success of your business strategy.

Many of these examples of strategic risk are inter-connected. For instance, if you face operational risks around the efficacy and rigor of your processes, this is likely to expose you to financial or regulatory risk. Similarly, if you fail to tackle governance risks, you may well encounter reputational risk.

The intertwined nature of the types of strategic risk emphasizes how important it is to take an 

How to tackle the different types of strategic risk

Amongst all these strategic risk examples, there are positives. The linkages that cause one risk to increase the chances of another can also work to your advantage. Take a coordinated, integrated stance on one aspect of strategic risk, and your performance in others should also improve. As companies refine their approaches to risk mitigation, they become better able to recognize these connections. As a result, they can approach risk strategically, capitalizing on synergies for a more robust result.

Below we also set out some specific tips that can help you tackle the different strategic risk examples:

 Remaining competitive means understanding your competition; data is key here, and technology can be your friend in enabling you to provide your board with the competitive intelligence they need.

 is the secret. Put governance at the heart of your change programs and reduce the risks they bring while enhancing their benefits.

 Keeping on top of the latest developments in the fast-moving regulatory landscape is vital here — you can't meet expectations if you're not aware of them. Ensure you keep abreast of the news and 

, and you have a better chance of swerving the risks that can derail your brand.

 There is less you can do here, although ensuring you build 

 rooted in countries where political volatility is less of a threat can help make your operations more resilient.

 As with change risk, robust governance processes and controls are essential to reducing risk here.

 While some financial risks come from external factors, improving your ability to measure, monitor and respond to the business risks you face, if done successfully, should minimize the financial threats that fall within your wheelhouse.

 can help here, reducing the threat from economic instability in countries you source from. And, again, 

 that can affect your risk profile is vital.

 One of the areas you have the most control over, introducing 

, rigor and structure to your operations can significantly reduce your risk across all areas of your organization.

Understand and respond to all types of strategic risk

Hopefully, this article has given you a deeper understanding of the types of strategic risk you face, some examples of strategic risk that bring this to life. It has also provided insights into how you can tackle different strategic risks.

Remaining on the front foot in terms of upcoming legislation, economic trends and governance best practice can really make the difference — amplifying your ability to be leverage strategic and proactive in the face of changing risks.

Stay proactive — learn alongside your peers

(February 5-6, 2025) is your must-attend event to uncover the latest in cyber threats, trends and governance strategies. This isn't just another conference — it's a free, global gathering that spans the Americas, EMEA and Asia-Pacific, bringing together the best and brightest minds in cybersecurity.

Dive into engaging discussions with renowned experts and peers, earn up to 4 CPE credits and learn how to articulate cyber risks to your boards and leadership with confidence and clarity.

Diligent

Blog

SEC cyber rules: Essential knowledge for boards and executives

9 strategic risk examples and how to successfully tackle them

Solutions

Resources

Company

Your Data Matters

Diligent

Blog

SEC cyber rules: Essential knowledge for boards and executives

9 strategic risk examples and how to successfully tackle them

SolutionsSolutions

ResourcesResources

CompanyCompany

Your Data Matters

Solutions

Resources

Company