"In satisfying their risk oversight function with respect to cyber security, boards should evaluate their company's preparedness for a possible cyber security breach." Discuss the statement.

In satisfying their risk oversight function with respect to cyber security, boards should evaluate their company's preparedness for a possible cyber security breach, as well as the company's action plan in the event that a cyber security breach occurs. With respect to preparation, boards should consider the following actions, several of which are also addressed in The Conference Board's "A Strategic Cyber-Roadmap for the Board" released in November 2016: identify the company's "Crown Jewels"-i.e., the company's mission-critical data and systems-and work with management to apply appropriate measures outlined in the National Institute of Standards and Technology (NIST) Framework. ensure that an actionable cyber incident response plan is in place that, among other things, identifies critical personnel and designates responsibilities; includes procedures for containment, mitigation and continuity of operations; and identifies necessary notifications to be issued as part of a pre-existing notification plan. ensure that the company has developed effective response technology and services (e.g., off-site data back-up mechanisms, intrusion detection technology and data loss prevention technology) ensure that prior authorizations are in place to permit network monitoring. ensure that the company's legal counsel is conversant with technology systems and cyber incident management to reduce response time.