The Vancouver Island University Audit Report – Board Oversight Of Cybersecurity Risk Management

Cyber risk management is a fundamental issue for universities, public bodies, and other organizations. The Auditor General of British Columbia recently issued an audit report finding a university's board of governors had not provided adequate oversight of the university's cybersecurity risk management practices. The report provides helpful guidance for university boards and other public boards of directors in British Columbia and across Canada.

Background

Cyber risks – risks of losses and costs/liabilities suffered or incurred by an organization as a result of an incident that adversely affects the organization's information technology systems or the confidentiality, integrity, or availability of the organization's data – are a critical organizational risk. The Canadian Centre for Cyber Security's National Cyber Threat Assessment 2023-2024 warns that ransomware is a persistent threat to Canadian organizations.