Businesses face new cybersecurity threats from new bad actors daily, and high-profile cyber failures have taken major companies to their knees—and their executives along with them. As such, cybersecurity and risk management are top-of-mind for boards of directors and their leadership teams, including NetApp.

In January of 2020, the Office of Compliance Inspections and Examinations of the Securities and Exchange Commission (OCIE) published its OCIE Cybersecurity and Resiliency Observations report. The report identifies practices for managing and combating cybersecurity risks based on thousands of reviews. The cybersecurity management practices addressed include:

  • Governance and risk management
  • Access rights and controls
  • Data loss prevention
  • Mobile security
  • Incident response and resiliency
  • Training and awareness
  • Vendor management

While all of these practice areas merit due consideration, vendor risk management is one area that has everyone's attention. Gartner research found that 75% of Fortune Global 500 companies treat vendor risk management as a board-level initiative to mitigate brand and reputational risk. While vendor risk management is a moving target, and staying one step ahead of the bad guys is extremely challenging, it is a "bet the company" issue, and it must be addressed comprehensively.