Post by Aleksey Krylov Photo by FLY:D on Unsplash
When it comes to finance cyber security, even minor breaches in a startup infrastructure can lead to dramatic consequences, ranging from actual dollars stolen to disrupted operations and reputational damage. As such, having an experienced CFO at the helm – even in a fractional capacity – can lead to significant savings in actual and opportunity costs. This is another reason fractional CFOs are popular in select industries.
Here are some salient finance cyber security concerns that a CFO can help a startup navigate:
Financial Cybersecurity Fraud
Experienced CFOs are vigilant about financial cybersecurity fraud, such as invoice scams or fraudulent wire transfers. These attacks are painful for a startup because the impact is immediate as the organization experiences a loss of cash. A recent example from my experience involved a wire transfer to an international service provider. My client’s email was compromised, and an intruder impersonating a wire-approving officer of the organization sent a note to the bank requesting a last-minute change in the wire instructions. Because the dollar amount was high – approximately $900,000 – the bank called me, the CFO of the organization. I stopped the wire and launched an investigation. We ascertained that the organization’s email was breached several days prior, and the approving officer never requested the wire instructions change. As a result, the finance team effected an immediate change in passwords organization-wide and implemented a 2-step authentication procedure for all systems.
Several months earlier, as a part of my CFO’s scope of responsibilities, I rolled out an authority to conduct business matrix, which, among other things, established protocols for approving and processing large wire transfers. Had this protocol was not in place, the bank would have adjusted the wire instructions and released the payment. And the company would be $900,000 poorer.
Data Breaches
Data breaches involving unauthorized individuals gaining access to sensitive information can have severe financial implications. The consequences may range from legal and regulatory penalties to loss of customer trust to costs associated with incident response, remediation, and notification. Depending on the industry, some ramifications are more applicable than others. For example, for a biotech a data breach may lead to a loss of secrecy in the DNA code or chemical composition of its proprietary product, and compromised intellectual property. For health services organizations dealing with patients, data breaches may lead to HIPAA violations and cause severe penalties from regulators. I expect the experienced CFO to work to isolate the most sensitive data repositories, including disconnecting such databases from the internet and limiting access to such information to only a handful of authorized individuals. I also expect CFOs to develop a plan to deal with contingencies, including cyber insurance, to mitigate the breach.
Business Continuity
Cyber attacks can disrupt business operations, leading to financial losses and potential reputational damage. In a startup, it is common for IT teams to report to the finance vertical as its lead serves as CAFO or chief administrative and financial/operating officer. I believe a CFO should work closely with IT internal teams and external experts to develop and test business continuity and disaster recovery plan to minimize the financial impact of such incidents.
Employee Awareness and Training
In my experience, humans are the weakest link in the cybersecurity armor for any startup. As a CFO, I am sensitive to cyber security awareness and drive training programs for employees and consultants. For the startup that came close to losing $900,000, as an outcome of that incident, I recruited a training consulting firm that conducted seminars for all employees to educate staff about phishing attacks, password security, and other cyber threats. In addition to other measures (e.g., email spam filters, anti-virus programs, or pop-up/URL blockers organization-wide), we recruited a firm to conduct fake attacks on the company to test for weaknesses. Employees would be subjected to emails or pop-ups that could compromise operations, and those who failed would be to conduct a training refresher again. I believe this proactive finance cyber security measure can significantly reduce the risk of successful cyber attacks.
Board-level Reporting
Finance cybersecurity is a Board-level governance matter. That is why it needs to be within the responsibilities scope of a “chief” (i.e., the most senior) executive versus a mid-level startup employee. A CFO is well suited to report to the Board of Directors regarding the risks to the organization’s financial health. Finance cybersecurity falls within such risks. It is essential to include cyber security metrics and mitigation strategies in the KPI reports to keep the Board informed about the impact of such threats.
Comments