'Put it on your board agenda!' - GUBERNA's Listed Company Day embraces cybersecurity

Introducing the link between governance & cybersecurity

In her introduction, Sandra Gobert outlined the organisers' threefold intention: to raise awareness about cyberthreats and cybersecurity, to provide a clear overview of the legal rules, and to offer practical guidance to board directors and CEOs. "We all must inform ourselves about the measures that companies can take to prevent and remedy cyberthreats. They have never been so prominent."

She acknowledged the valuable work of the GUBERNA Sounding Board Committee for Cybersecurity, which has published important materials and potential board solutions in this area. Recalling Sounding Board Committee Chairman Alex Driesen's key points, she emphasised why cybersecurity demands heightened attention from a board perspective:

Beware of cybercrime

EY's Partner for Technology Consulting and Cybersecurity, Koen Machilsen, reinforced the awareness message with crucial warnings: cybercrime is big business, and this sector operates as a well-oiled machine of professional criminals. They have even developed excellent customer support for their victims: "When you get hacked, you end up on a user-friendly website!" Moreover, these cyber opponents quickly adopt new technologies. .

The number of security flaws and vulnerabilities is spiralling, with ransomware as a top-ranked danger. Its financial impact causes $8 trillion in annual damages.

He specifically illustrated how a ransomware attack strikes all business fronts. An effective response against a cyber attack requires robust coordination and necessitates cooperation throughout the entire organisation. "This is not just an IT matter." The priority is containing or isolating the problem.

Recovery to business as usual is challenging: organisations must prioritise their actions effectively.

"Cybercriminals always look for the weakest link. That may also be the company directors."

What about NIS2?

Of course the conference dedicated significant attention to the new NIS2 regulation. Both Koen Machilsen and A&O Shearman's Peter Van Dyck and Sarah De Wulf provided excellent explanations, receiving numerous requests for clarification from the engaged audience. NIS2 is quite complex and cannot be separated from other regulations such as DORA, GDPR, eIDAS, the Cyber Resilience Act and the Cyber Security Act. But we refer readers to our comprehensive overview addressing what directors certainly need to know about NIS2.

Peter Van Dyck and Sarah De Wulf concluded with some concrete advice for boards to deal with these new legal requirements:

• Put cybersecurity as a recurring theme on the management’s and board’s agenda.
• Expand the knowledge of your management and your board through training, reporting, certifications, etc.
• Be prepared for incidents, establish a crisis plan and response to cybersecurity threats.
• Supervise the compliance with legal requirements. Supervisory authorities hold management accountable for cybergovernance and compliance.
• Provide management with directions and authority to act, determine a cybersecurity budget.

Panel discussion

Following the break, a distinguished panel gathered around Valéry Vander Geeten, Head of Legal at CCB (Centre for Cybersecurity Belgium):

• Marc Vael, Digital Information Security Expert at Veralto
• Nathalie Ragheno, Senior Advisor at VBO FEB
• Danielle Jacobs, CEO at BELTUG
• Fabrice Clément, CISO at Proximus

Board matters

Marc Vael emphasised: "Board members should not fear the word 'cyber' as it's not merely a 'technology first' matter. Consider it holistically, as it encompasses people, teams, processes, audits, reviews and strategic vision. Put cybersecurity regularly on the board agenda as a planned and prepared item."

He emphasised the importance of accessible language in reporting, structuring his board presentations in these seven chapters:

1. Current threat landscape
2. Regulatory framework overview
3. Internal organisation status
4. Cybersecurity improvement programme and investments
5. Employee awareness initiatives
6. Customer awareness and resilience support
7. Cybersecurity collaboration overview

Collaboration for more awareness

Nathalie Ragheno stressed the importance of collaboration between competent authorities, including the CCB and business federations (such as VBO-FEB), to provide effective tools and guidance. “Many managers still lack a clear vision of what needs to be given priority protection and what are their most crucial assets. In that respect the new legislation will help as it creates a structure for their story towards the board.” She acknowledged that whilst larger companies might find compliance easier, SMEs often lack the resources to prioritise cybersecurity effectively.

The CIO and CISO relationship

Danielle Jacobs noted BELTUG's observation of more CISOs (Chief Information Security Officers) reporting directly to boards alongside CIOs (Chief Information Officers). She emphasised the importance of clear, non-technical communication with boards: "Don't show them what you're doing; show them what decisions need to be made. Ask for clear choices between options which all may have different effects and costs. By interacting with you, your board can give you and your work a lot of credibility!”

NIS2's regulatory requirements create a positive business dynamic where robust cybersecurity becomes a competitive advantage, as customers and supply chain partners increasingly demand high security standards, thereby helping CISOs justify larger security budgets.

BELTUG’s annual survey confirms AI, cybersecurity and regulatory compliance as the top three board concerns, with strong alignment between CIOs, CEOs and boards.

"Cybersecurity is not a matter of IT, it is everywhere in the organisation."

A last practical advice for boards during cyber crises:"Be prepared! It will be a long meetingb,so provide refreshments and good food!"