Three questions for boards and CEOs to ask their corporate affairs team
Cybersecurity is more than an IT issue
In today’s digital landscape, cyber threats are a matter of when, not if. A single attack can cause reputational damage, regulatory scrutiny, and financial losses. CEOs and boards must ensure their organisations are prepared to respond effectively, and that starts with corporate affairs.
At Orizontas, we have worked with three leading organisations in the last year across housing, government and resources, supporting them in navigating cybersecurity challenges. The insights in this article come from real-world experience—helping corporate affairs teams at Australian private and public sector bodies define their role in cyber crisis management.
Corporate affairs teams are on the frontline of crisis communication. If a breach occurs, how they respond will shape stakeholder trust and regulatory outcomes. The Australian government has recently passed cyber security legislation defining new obligations on companies to report and cooperate with national security agencies. Boards and CEOs need to understand how these regulatory changes will affect their businesses.
To assess preparedness, here are three key questions to ask:
1. Do we have a cyber-specific crisis communication plan?
Before considering the role of corporate affairs, leadership must confirm that a structured, tested plan exists for responding to a cyber crisis. Without one, even the best coordination across teams will not be effective.
Checklist for boards and CEOs:
☑ If a cyber event happens today, do we know exactly how to respond?
☑ Have we tested this plan through a real-world crisis simulation?
☑ Do we have pre-approved messaging for different cyber incidents (e.g., ransomware, data breaches)?
☑ Are our regulatory disclosure processes clear and aligned with compliance requirements?
Example:
A small government agency recently faced questions from their board directors about the risk and preparedness for cyber-breaches. Because they had invested in an issues and crisis management plan that addressed the current cybersecurity risks, they were able to demonstrate the risks the organisation faced and enable the board to easily test the preparedness.
2. Do corporate affairs understand our cybersecurity approach?
Even with a plan in place, a cyber crisis response can only be effective if corporate affairs know their role and can communicate cybersecurity risks clearly. This team must be able to explain the company’s cybersecurity measures in simple, confident terms to employees, customers, and regulators.
Checklist for boards and CEOs:
☑ Can corporate affairs explain our basic cybersecurity protections in simple terms?
☑ Do they know our biggest cyber risks and how they could impact reputation?
☑ If an incident occurred, could they outline who handles communication and what steps would be taken?
Example:
Orizontas’ globally recognised cyber-security expert Dr Carl Ungerer and geopeolitical expert Patrick Gibbons have run private and group briefings for over 50 heads of Corporate Affairs and executive teams around Australia and NZ. These provide critical context for on the geopolitical environment, most likely cyber risks and what to expect from national security agencies in an event of a crisis. These workshops arm corporate affairs with the information they need to ask the right questions to prepare.
3. Is there a clear process for working with IT and HR in a cyber crisis?
A cybersecurity crisis isn’t just an IT problem—it’s a company-wide issue. Corporate affairs, IT, and HR must work together before an incident occurs to ensure smooth execution when it matters most.
Checklist for boards and CEOs:
☑ Is there a designated point of contact between corporate affairs and IT/security teams?
☑ Has corporate affairs been part of a cybersecurity response drill in the past year?
☑ Are internal and external response protocols clear if an incident affects employees, customers, or investors?
Example:
Orizontas undertook a cybersecurity simulation for a company that held large amounts of personal data on behalf of a government agency. Their simulation identified clear gaps in the corporate affairs and executive team’s knowledge of cybersecurity environment and protections. This simulation enables the organisation to identify and solve these gaps in information critical to a timely and effective response.
What happens next?
If you asked your corporate affairs team these questions and found gaps, now is the time to act.
If gaps exist:
· Define clear crisis roles and responsibilities across teams.
· Schedule coordination meetings quarterly between corporate affairs, IT, and HR to align on cybersecurity response.
· Conduct joint crisis simulations annually to test how teams work together under pressure.
If you’re confident in preparedness:
· Review and update your plans regularly [suggest a time period if appropriate].
· Stay informed on evolving cyber threats and regulations [how?].
How Orizontas can help
– Expert cybercrisis and geopolitical briefings – To educate your executive team in the current global environment, the likely risks in the future and where best to focus resources now for the best possible response.
– Cyber crisis preparedness assessment – Evaluate your company’s existing processes and identify weaknesses.
– Crisis simulation and training – Run real-world cyber response simulations for corporate affairs, IT, and leadership teams.
– Crisis communication strategy – Developessaging and media response frameworks tailored to cyber threats.
About the author
Vanessa is the co-founder and partner of Orizontas Group. She is a strategic communications professional and for over 25 years has been trusted by some of the world’s largest brands to provide counsel on issues and crisis mitigation and corporate affairs. Orizontas pairs these skills with globally recognised experts in cybersecurity, intelligence and foreign affairs to provide integrated counsel and real-world solutions. Vanessa is a recognised industry leader, a Fellow of Communications and Public Relations Australia, a sessional academic at UTS School of Communications and a member of Chief Executive Women.
Vanessa has an MBA from Macquarie Graduate School of Management and a Bachelor of Communication (Organisational Communication) from Charles Sturt University (Mitchell).
Phone Number: +61 (0) 418 662 168
Email: vanessa.liell@orizontas.com.a
Linkedin: https://www.linkedin.com/in/vanessalie