The document summarizes the results of a Deloitte poll of C-suite executives about cybersecurity. The poll found that most executives expect boards to request more reporting on cybersecurity risk management effectiveness in the next 12 months. It also found that Chief Information Security Officers most commonly report to the CEO or Chief Compliance/Risk Officer. Across industries, confidence in cybersecurity programs was mixed, with most expressing some confidence but few expressing high confidence.

1. Fight the good fight:
Three lines of cyber defense
working arm-in-arm
Deloitte poll results from February 2018

2. Fight the good fight:
Three lines of cyber defense working arm-in-arm
Copyright © 2018 Deloitte Development LLC. All rights reserved. 2
Methodology
C-suite and other executives participated in a
Deloitte Dbriefs webcast, titled “Fight the
good fight: Three lines of cyber defense
working arm-in-arm,” on Feb. 22, 2018 about
the role of any organization’s three lines of
defense in cybersecurity. Respondents
largely work in the financial services (29.1
percent), consumer and industrial products
(26.9 percent) and technology, media and
telecommunications (16.6 percent) industries.
Answer rates differed by question.
1,130+
Fight the good fight:
Three lines of cyber defense working arm-in-arm
2

3. Fight the good fight:
Three lines of cyber defense working arm-in-arm
Copyright © 2018 Deloitte Development LLC. All rights reserved. 3
All C-suite and
exec votes
Consumer &
Industrial
Products
Energy &
Resources
Financial
Services
Life Sciences /
Health Care
Technology,
Media &
Telecomm
Do you expect your organization’s board to request more
cybersecurity risk management effectiveness reporting in the
next 12 months?(By Industry)
62.7%
57.4% 57.1%
69.9% 71.8%
66.3%
14.6%
11.7%
9.7%
28.6%
18.9%
15.2%
Yes No
Votes received: 1,267 overall; 1,064 for industries shown
Don’t know / Not Applicable = 22% all; 23.7% C&IP; 14.3% E&R; 20.3% FSI; 16.5% LSHC; 19% TMT

4. Fight the good fight:
Three lines of cyber defense working arm-in-arm
Copyright © 2018 Deloitte Development LLC. All rights reserved. 4
To whom does your organization’s Chief Information Security
Officer (CISO) report?
CISO
25.4%
CEO
9.7%
Chief Compliance
Officer or
Chief Risk Officer
28.5%
CIO
3%
Chief Legal Officer
Votes received: 1,354
Not Applicable = 20.5%
12.9%
Do not know

5. Fight the good fight:
Three lines of cyber defense working arm-in-arm
Copyright © 2018 Deloitte Development LLC. All rights reserved. 5
How confident are you in the effectiveness of your organization’s
current cybersecurity program? (By Industry)
Not ConfidentSomewhat ConfidentHighly Confident
All C-suite and
exec votes
Consumer &
Industrial
Products
Energy &
Resources
Financial
Services
Life Sciences /
Health Care
Technology,
Media &
Telecomm
16.7%
57.4%
11.9%
16.6%
13.4%
11.4%
5.6%
22.2%
13%
14.3%
25.4%
7.1%
11.8%
16.6%
14.7%
15.2%
6.1%
15.2%
Votes received: 1,274 overall; 1,064 for industries shown
Don’t know / Not Applicable = 14.1% all; 58.6% C&IP; 59.3% E&R; 53.1% FSI; 63.6% LSHC; 56.9% TMT

6. Fight the good fight:
Three lines of cyber defense working arm-in-arm
Copyright © 2018 Deloitte Development LLC. All rights reserved. 6
Do you expect US regulatory scrutiny of corporate cybersecurity
programs to change in the next 12 months? (By Industry)
Yes - Increase No Change Yes - Decrease
3.9%
22.8%
57.3%
3.2%
27.2%
53.5%
3.8%
21.2%
55.8%
2.7%
14.4%
69.5%
3.2%
31.6%
51.6%
6.1%
22.3%
54.3%
Votes received: 1,218 overall; 1,020 for industries shown
Don’t know / Not Applicable = 15.9% all; 16.1% C&IP; 19.2% E&R; 13.5% FSI; 13.7% LSHC; 17.3% TMT
All C-suite and
exec votes
Consumer &
Industrial
Products
Energy &
Resources
Financial
Services
Life sciences /
Health care
Technology,
Media &
Telecomm

7. Fight the good fight:
Three lines of cyber defense working arm-in-arm
Copyright © 2018 Deloitte Development LLC. All rights reserved. 7
Will your organization adopt the AICPA’s SOC for Cybersecurity
risk management reporting framework in the next 12 months?
Yes, we are
currently
conducting an
enterprise-wide
readiness
assessment
Yes, we are
currently working
toward adoption
No, but we
plan to
No, and we do
not plan to
5.6%
13.6% 13.1%
17.0%
Yes, in next 12 months
19.2%
Yes, at some point
32.3%
Votes received: 1,131
Don’t know / Not Applicable = 50.8%

8. Fight the good fight:
Three lines of cyber defense working arm-in-arm
Copyright © 2018 Deloitte Development LLC. All rights reserved. 8
Media contact
Lauren Hallman
Public Relations
Deloitte Services LP
lahallman@deloitte.com
Shelley Pfaendler
Public Relations
Deloitte Services LP
spfaendler@deloitte.com
Full press release available on
Deloitte.com
Fight the good fight:
Three lines of cyber defense working arm-in-arm
8

9. About Deloitte
Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), its network of member firms, and
their related entities. DTTL and each of its member firms are legally separate and independent entities. DTTL (also referred to as “Deloitte Global”) does not
provide services to clients. In the United States, Deloitte refers to one or more of the US member firms of DTTL, their related entities that operate using the
“Deloitte” name in the United States and their respective affiliates. Certain services may not be available to attest clients under the rules and regulations of
public accounting. Please see www.deloitte.com/about to learn more about our global network of member firms..
Copyright © 2018 Deloitte Development LLC. All rights reserved.
The statements in this report reflect the aggregation of poll responses and are not intended to reflect facts or opinions of any entities. All data, charts and
statistics referenced and presented, as well as the representations made and opinions expressed, unless specifically described otherwise, pertain only to
the participants and their responses to the Deloitte poll. The information obtained during the poll was taken “as is” and was not validated or confirmed by
Deloitte.
This presentation contains general information only and Deloitte is not, by means of this presentation, rendering accounting, business, financial,
investment, legal, tax, or other professional advice or services. This presentation is not a substitute for such professional advice or services, nor should it
be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business,
you should consult a qualified professional advisor.
Deloitte shall not be responsible for any loss sustained by any person who relies on this presentation.