Skip to main content

      Regulators now expect management bodies to define, approve, oversee and be accountable for ICT and cyber risk. Boards need cyber information they can act on: risk in business terms, a clear appetite and tolerance, and progress against plan.

      Too often, Board reporting is a long list of technical indicators that does not support a decision. We build programmes to baseline, measure and report on the health, progress and value of the cyber security programme, and to express cyber risk in financial terms, so directors can challenge, prioritise and fund with confidence.

      How we help

      • Board and executive cyber governance, committee structures and reporting design
      • Board cyber briefings and training on regulatory responsibilities
      • Integration of cyber risk into enterprise risk reporting

      Outcomes

      • Board reporting focused on decisions, not technical detail
      • A defined and measured cyber risk position
      • Clear evidence of management-body oversight for supervisors

      Cyber Risk Management

      A clear appetite turns cyber risk discussions into decisions. We help Boards set appetite and tolerance levels linked to critical services, impact tolerances and quantified loss exposure.

      • Cyber risk appetite statements aligned to the enterprise risk appetite framework
      • Tolerance thresholds and escalation triggers
      • Linkage to impact tolerances for critical or important functions
      • Measurement of risk position against appetite using quantification

      We baseline, measure and report on the health, progress and value of the cyber programme, with KRIs linked to appetite and KPIs linked to the roadmap, building on the KPMG CISO metrics and reporting approach (Metrics 360).

      • KRI and KPI library with definitions, owners, data sources and thresholds
      • Board, executive and operational dashboards
      • Alignment with DORA and operational resilience reporting expectations
      • Automated metric collection through GRC platforms

      Few organisations can strengthen every control everywhere. KPMG Cyber Risk Insights (CRI) takes a scenario-driven approach to assess the likelihood and financial impact of cyber attacks, drawing on more than ten years of KPMG quantification experience. KPMG was named a Leader in The Forrester Wave™: Cyber Risk Quantification Solutions, Q2 2025.

      • Threat scenarios relevant to your business and attack-path modelling
      • Monte Carlo simulation and loss exceedance curves
      • Cost-benefit analysis of planned initiatives and investment prioritisation
      • Support for cyber insurance and capital reserve decisions
      • Repeatable assessments to track risk reduction over time

      We align cyber and ICT risk management with ISO 31000 principles, so cyber risk is assessed, reported and governed consistently with other enterprise risks.

      • Cyber and ICT risk management framework and methodology
      • Risk taxonomy, assessment scales and risk register
      • Integration with Integrated Risk Management and ERM reporting

      Contact

      Constantinos Gavardinas

      Partner, Advisory

      KPMG in Greece