Board-Level Security Strategy at a Regional Bank
Cedar Valley Bank has 15 branches, 900 employees, and a core banking platform outsourced to a Tier-1 provider. The board has approved a three-year digital strategy: open banking APIs, mobile onboarding, and cloud-based analytics. The CISO reports to the CIO, and security budget is 4% of IT spend. Internal audit found that security strategy is a one-page document focused on compliance checklists and not linked to business objectives. The CIO and CISO disagree: the CIO wants to fund API security and customer identity; the CISO wants endpoint detection and a SOC. The board risk committee asks who owns cyber risk and how it will know whether the strategy is delivering. Regulatory examinations are annual and focus on operational resilience.
1. Recommend a security governance model for Cedar Valley Bank, including decision rights, reporting lines, and the role of the board risk committee. Justify why the current CISO-to-CIO line may or may not remain.
Read the worked answer
A workable model separates oversight, decision rights, and delivery. The board risk committee should own the cyber risk appetite and receive assurance; it should not approve individual controls. The CISO should set security strategy, standards, and risk assessment, and should have a reporting line to the CEO or directly to the board risk committee, with a dotted line to the CIO for delivery. The current CISO-to-CIO line creates a conflict: the CIO is accountable for delivery speed and budget, while security must sometimes slow or stop delivery. Independence matters more because core banking is outsourced and operational resilience is regulated.
A Security Steering Committee should include the CISO, CIO, business line heads, risk, audit, and a supplier manager. Its decision rights: approve security strategy and risk appetite within board limits; prioritize security investments; resolve escalations; review material risks. The CIO owns technology delivery and supplier performance; the CISO owns control design and assurance; business owners accept residual risk for their services. Internal audit provides independent assurance. This reflects ITIL 4 governance as direction, monitoring, assurance, and communication, not a single org chart fix.
2. Describe how to align the security strategy with the bank's digital strategy and the ITIL 4 governance approach (direction, monitoring, assurance, communication). Include how to resolve the funding conflict between API security and SOC/endpoint.
Read the worked answer
Align by translating each digital objective into security outcomes. Open banking APIs require API security, strong customer authentication, and third-party access governance. Mobile onboarding requires identity proofing and fraud controls. Cloud analytics requires data classification, encryption, and supplier assurance. The strategy should state these outcomes and the risk appetite for each.
Resolve the funding conflict with a risk-based investment case, not a compromise. Assess the likelihood and impact of API failure versus endpoint/SOC gaps against the bank's risk appetite and regulatory resilience expectations. If API security is a launch dependency for open banking, fund the minimum viable API security and customer identity first, with a time-bound plan for SOC and endpoint. If endpoint gaps create unacceptable operational resilience risk, fund detection and response first and phase API work. The steering committee should decide using agreed criteria: regulatory exposure, customer impact, revenue dependency, and threat likelihood. ITIL 4 governance supports this through direction from the board, monitoring by the committee, assurance from audit, and communication to stakeholders. The CISO should present options with residual risk, not a single budget demand.
3. Propose a dashboard for the board risk committee with three to five metrics that show strategic security performance, not just compliance. Explain the reasoning behind each metric and its limitations.
Read the worked answer
Board metrics should show strategic performance and residual risk.
- Material risks outside appetite and remediation status: shows whether the strategy is reducing the bank's most important exposures. Limitation: risk ratings are subjective and can be manipulated; audit should validate.
- Percentage of critical services with tested resilience and incident response: reflects operational resilience, which regulators examine. Limitation: a test may not represent a real attack; vary scenarios.
- API security and customer identity performance: for example, percentage of APIs passing security tests and fraud rate on mobile onboarding. This links security to the digital strategy. Limitation: technical pass rates do not prove business control.
- Tier-1 supplier assurance coverage: percentage of critical suppliers with current security attestation and tested exit/incident arrangements. This matters because core banking is outsourced. Limitation: attestations can be stale.
Include a short narrative on changes in the threat landscape and major incidents. The reasoning: the board needs a balanced view of risk, resilience, strategic enablement, and supplier dependence, not a compliance checklist.