Implement best practices and industry standards rather than relying solely on compliance or certifications. Regulations are good guidelines, but businesses can, and should, do more that goes beyond those requirements. Tailor security best practices for your company’s specific needs so that you can be proactive in fighting potential threats, rather than doling out resources as a reactive response to new threats.

Engage your entire leadership team in cybersecurity and risk-management conversations. CEO’s can protect themselves only to the extent that employees are aware of the risk involved in clicking on an unknown link, or responding to a risky email request, for example. Therefore, executives need to construct policy from the top down to ensure that everyone is aware of the action items related to their part in mitigating cybersecurity risks. A top-down policy outlines roles and mitigates the power struggles that can inhibit IT security.

Process. Process. Process. Make sure you have created a repeatable standard process in which to cross-train your staff to perform incident and risk management as an institutional practice. We’ve seen too many cases where only a few employees in the company have the expertise in key subject areas. This presents a huge risk to the company.

“You can’t move what you don’t measure.” Your process must be measurable and meaningful for it to be effective. An example of a meaningful metric is measuring the amount of time it takes for your company to identify, respond to and fix a pivotal vulnerability in your structure. By reducing the number of hours (or for some companies, days) which the process takes, you can effectively mitigate risk across your whole enterprise. An example of an ineffective metric would be to measure how many alerts your CEO receives in regard to potential vulnerabilities. Such information is useless in terms of relevancy and application to this particular instance.

Implement situational awareness of cybersecurity dangers. Subscribe to notifications (e.g., National Cyber Awareness System products, MITRE Common Vulnerability Exposures, CERT Coordination Center Vulnerability Notes) to stay up-to-date on the latest in developing cybersecurity threats.