Advancing Cyber Resilience Principles and Tools for Boards

The World Economic Forum, in collaboration with The Boston Consulting Group and Hewlett Packard Enterprise, developed this report to address the gap in board-level capabilities for managing cyber risks. It argues that cyber resilience is a leadership and strategic issue rather than a purely tactical one. The report introduces ten Board Principles for Cyber Resilience, a set of toolkits for board-management dialogue, a Board Cyber Risk Framework for quantifying risks, and guidelines for overseeing emerging technology risks, such as the Internet of Things (IoT).

• Cyber resilience is characterized as a leadership and strategic challenge rather than a tactical one, meaning that the responsibility for managing these risks resides with the board and top-level executive teams.
• There is a significant demand for board-level tools, with 84% of surveyed board members agreeing that better cyber resilience tools and guidelines are necessary to support their oversight work.
• The report establishes ten core principles for boards, which include taking ultimate responsibility for oversight, ensuring board members have a command of the subject, appointing an accountable officer, and conducting annual independent reviews.
• The Board Cyber Risk Framework defines cyber risk as the combination of the probability of an information system incident and its impact on assets, which can be categorized as tangible, intangible, or the 'greater good' (such as safety of life).
• The report identifies three primary categories of vulnerabilities that boards should oversee: people and culture, processes and organization, and technology and infrastructure.
• Emerging technologies, specifically the Internet of Things (IoT), introduce disruptive risks to cyber resilience; a survey of market leaders found that 88% believe businesses are currently not ready for this disruption.
• The report provides specific IoT case studies to illustrate risks, including the potential for unauthorized control of pacemakers, the exposure of trucking fleet data via Telemetry Gateway Units, and the exploitation of wireless radio communications to control traffic lights.
• The World Economic Forum intends to develop a platform for the anonymous sharing of board risk assessments to enable industry-specific benchmarking of cyber risk portfolios and management costs.

APA

World Economic Forum (2017). Advancing Cyber Resilience Principles and Tools for Boards. http://www3.weforum.org/docs/IP/2017/Adv_Cyber_Resilience_Principles-Tools.pdf

Chicago

World Economic Forum. Advancing Cyber Resilience Principles and Tools for Boards. 2017. http://www3.weforum.org/docs/IP/2017/Adv_Cyber_Resilience_Principles-Tools.pdf.

Wikipedia

{{cite report |author=World Economic Forum |title=Advancing Cyber Resilience Principles and Tools for Boards |date=January 2017 |url=http://www3.weforum.org/docs/IP/2017/Adv_Cyber_Resilience_Principles-Tools.pdf |access-date=23 October 2026 |via=Climate Insights Directory}}

BibTeX

@techreport{worldeconomicforum2017advancing, author = {{World Economic Forum}}, title = {{Advancing Cyber Resilience Principles and Tools for Boards}}, institution = {World Economic Forum}, year = {2017}, month = jan, url = {http://www3.weforum.org/docs/IP/2017/Adv_Cyber_Resilience_Principles-Tools.pdf}, urldate = {2026-10-23}, note = {Indexed by Climate Insights Directory} }