Cyberattacks are undoubtedly onthe rise. Companies are no longer concerned about whether an attackwill occur, but rather when and how their most valuable data willbe breached. Increasing in sophistication, today's cyberattacks canimpact all areas of an organization for years after the initial attack and can cost millions—if notbillions—in damages.

A number of regulations focused on improving cybersecurityprograms have been introduced over the past few years, including arecent regulation finalized by the New York Department of FinancialServices (NYDFS) requiring banks, insurance companies, and otherNYDFS-regulated entities to establish and maintain an effectivecyber risk management program. Still, the magnitude of stoleninformation remains staggering, and the challenges associated withprotecting data continue to grow.

Not all cyberattacks are made public, but it seems as though anew breach makes headlines every day. Only recently has acomprehensive framework for reporting cyber risk managementactivities become available: The American Institute ofCertified Public Accountants (AICPA) recently released a newattestation reporting framework intended to help organizationsevaluate and report on their cyber risk management programs.Designed to expand cyber-risk reporting to a broad range ofinternal and external users, including the C-suite and the board,the AICPA's new reporting framework aims to provide in-depth,easily consumable information about an organization's cyber riskmanagement program.