As cyber risk expectations continue to rise, many firms are moving beyond defining roles and responsibilities to testing whether they are actually working in practice. The ORX Cyber Roles and Responsibilities study captures how financial services firms are organising and overseeing cyber risk across the three lines of defence, based on insights from industry peers.
In this blog, we share a practical checklist based on the study findings, which sets out key questions you can use to review your operating model, accountability, oversight and resourcing.
Get further insights
Use this report to support and strengthen your cyber risk management approach across the three lines of defence. The insights can help you:- Benchmark roles and responsibilities against wider industry practice and understand where key cyber risk activities typically sit
- Support conversations on people and skills, using industry context on headcount, capabilities and certifications to inform recruitment and regulatory discussions
- Review cyber risk reporting, including common formats and frequencies used by second-line teams
- Compare testing and oversight approaches, particularly how responsibilities are shared across the lines of defence
ORX Cyber subscribers can download the report to read the full insights and analysis.
Non-subscribers can now download a free summary with key findings and conclusions.
Regular review of operating model
Carry out a review of your model at least every two years to ensure that it best fits the changing internal and external environment.
Key questions
-
Have you reviewed your cyber risk management operating model in the past 2 years?
-
If applicable, are you engaging effectively with local entities regarding cyber risk management?
Clarity on roles and responsibilities
Consider whether the second line is primarily engaged in oversight activities, providing checks and challenges to the first line’s efforts, providing support and guidance, and establishing overarching risk frameworks and methodologies.
Key questions
-
Have you clearly documented and communicated the responsibilities of the 1st and 2nd line?
-
Is ownership of policies, frameworks, and methodologies clear?
Documentation of cyber risk management capabilities
Ensure you have up-to-date and consistent information on cyber teams available to provide to supervisors where necessary.
Key questions
-
Have you documented the skills and experience of your team?
-
Have you documented the number of FTEs involved in cyber risk
management across the three lines of defence? -
Is it clear what should be counted in these FTE totals?
Ownership of cyber metrics and indicators
Review whether any changes are necessary regarding ownership of cyber metrics (and documentation).
Key questions
-
Is there clarity over ownership of cyber metrics?
-
Is this approach delivering the desired results in measuring cyber risk exposure?
Collaborative effort for controls testing and oversight
Consider the appropriate level of involvement of the 2LOD in controls testing and whether a narrow focus on key controls (to complement more extensive 1LOD testing) is the most effective use of resource.
Key questions
-
Have you established clear roles and responsibilities for controls oversight?
-
Is the scope of 2LOD controls testing appropriate for your needs?
Awareness and review of cyber budgets
Review your cyber risk management budget on an annual basis, including evaluation of whether additional budget (or reallocation) is necessary to ensure that skills are kept up to date.
Key questions
-
Do you know how much budget is assigned to 2nd line cyber risk management activities overall?
-
Do you know how much budget is assigned to training and upskilling 2LOD cyber teams?
-
Is the available training budget sufficient for your needs going forwards?
ORX Cyber - supporting the 2LOD
About ORX Cyber
ORX Cyber supports second line practitioners with the intelligence they need to manage and measure cyber risk. Designed specifically to support financial organisations, ORX Cyber provides many benefits, including:
- Access to crucial cyber event insights through data exchange
- Collaboration and engagement with experts and your peers
- In-depth research helping you make informed decisions and improve practice
