Cyber security requires an enterprise-wide approach, and the risk manager’s role is to help the company achieve effective, data-based enterprise risk management, the Federation of European Risk Management Associations (FERMA) has told the European Commission.

1. Press Release 14 March 2016
Cyber security is an enterprise risk, FERMA tells the European
Commission
Cyber security requires an enterprise-wide approach, and the risk manager’s role is to
help the company achieve effective, data-based enterprise risk management, the
Federation of European Risk Management Associations (FERMA) has told the European
Commission.
In its response to the Commission’s consultation on public-private partnerships in cyber
security concluded last week, FERMA stated: “Businesses have difficulties with reaching a
basic level of protection often due to a lack of risk insights and data driven risk
mitigation.”
FERMA President Jo Willaert, commented: “The boards of organisations need to
understand that cyber risk is not only an IT risk; it is an enterprise risk. In that respect, we
advocate a central role for the risk management function. Without being an IT specialist,
the risk manager provides expert advice to support the board and the CEO. He or she is
working hand in hand with the operational units such as IT, legal and internal audit.”
FERMA stressed that this overview of cyber risks across an organisation, including into
the supply chain, is critical especially with the development of the Internet of Things.
Using scenario-based analysis, the risk manager can quantify the overall cyber risk
exposure and validate mitigation strategies on an enterprise basis.
FERMA also argues that public intervention is necessary in order to help organisations
cope with the challenge of cyber risks. It urges the development of:
 A framework for the clarification of cross-border liabilities in cyber incidents;
 A global set of rules for cyber risk assessment that would safeguard
confidentiality in incident disclosure and insurance claims;
 The incorporation of cyber risk governance in legislation and guidance to create
an integrated approach to the threats from top to bottom of the organisation.
Jo Willaert said: “Cyber threats are now of a systemic nature. Businesses, governments
and insurers, therefore, need to collaborate. We must act now.”

2. For FERMA’s full response to the Commission, see
http://www.ferma.eu/blog/2016/03/cyber-security-enterprise-risk-ferma-tells-
european-commission/
Typhaine Beaupérin, FERMA CEO: typhaine.beauperin@ferma.eu, tel: +32 (2) 761 94 31
Lee Coppack, press contact: lee@coppack.co.uk, tel: +44 208 318 0330/+44 7843 089904
All FERMA press releases can be found here.
About FERMA
FERMA - The Federation of European Risk Management Associations brings together 23
national risk management associations in 21 European countries. FERMA represents the
interests of over 4700 risk and insurance managers in Europe active in a wide range of
business sectors from major industrial and commercial companies to financial institutions
and local government bodies. More information can be found at www.ferma.eu