Cyber security: a growing boardroom priority – lessons from CIOs

Beltug’s 2025 Belgian Business ICT Market Study details the results of a broad survey of 1,159 respondents, with the findings discussed by a panel of ICT decision-makers during a round table discussion. The full downloadable report is available for members after login. We also have brief summaries available (in French and Dutch), including a summary infographic (no login required). We have also published a 7-page report on the findings of the CIO panel here.

Rising risks and regulatory pressure

As digitisation accelerates across sectors, so too do the risks. In response, a rising number of companies are implementing a cyber incident response plan. They recognise that an incident can quickly cause major reputational damage and financial loss. Awareness of these risks, combined with the increasing regulatory demands of European directives such as NIS2 and Dora, is driving them to take action.

This evolution appears to be fairly recent: in Beltug’s 2021 and 2023 surveys, the number of large companies with a breach plan remained stable at 74%. But thanks in part to prominent media coverage of cyber incidents in recent years, the realisation that every organisation is a potential target has spread – an awareness reflected in the latest survey.

Critical business impact

According to one decision maker: “Security is no longer only a technology issue. The impact of a cyber incident is potentially enormous, and that makes it a business issue.” He also noted that if 92% of large companies have a cyber incident response plan in place, then 8% still don’t, which is remarkable given today’s cyber climate.

On the other hand, the 92% result may be exaggerated: assuming most companies are aware of rising cyber risks, some might feel it is more ‘acceptable’ to indicate they already have a plan in place. Furthermore, it’s not enough to simply have a plan – it must be a solid blueprint. As another decision maker commented, “The ‘plan’ can’t merely tell you to call an external partner in the event of an incident.”

Complex exercise

Whatever the content of the plan, it can only be effective if it has been tested. Even for a ‘solid’ plan, in practice the response to an incident does not always go as expected. Some unexpected priorities may take precedence, such as communicating with customers.

While CIOs don’t dispute the value of having a plan, it’s not always clear how it should be implemented, and how far the organisation should go. Developing a complete business continuity plan is a very complex exercise. One approach is to first determine the priorities, then continue to expand and improve on the plan over time.

Board awareness

Furthermore, the days when cyber security consisted of a few technical measures and a fallback plan is long gone. As one of the participating CIOs summarised, “Today, security has become a business issue that must be considered at Board level. Boards now recognise that while restoring a backup may no longer be as technically difficult, winning back the customers lost because of a cyber incident is far more challenging.”

Is your organisation ready?

Does your organisation have a tested, regularly updated cyber incident response plan? Is cyber security a standing item on your Board’s agenda? What’s your view on how to improve cyber security in Belgium?

You, our members, form a rich bank of knowledge and we at Beltug are committed to building on that strength. Share your insights with us here.