Concerns about cybersecurity are growing every day. Treasury and risk professionals need to watch for, and guard against, payments fraud, ransomware, and data breaches, while also ensuring security is adequate within third-party vendors of the applications and cloud services their company relies on.

Meanwhile, the pressure is on from regulators. The latest SEC guidance on the topic encourages public companies to disclose cybersecurity risks and to describe in financial terms any exposures that are material from a business perspective. To effectively meet this guidance, treasury and finance managers should answer some basic questions about their cybersecurity risk posture:

• What risks do we face?
• What is the financial value of these exposures?
• Which risks pose the largest threat?
• How much should we spend, and where, for best results to mitigate these risks?

Gathering this information is crucial to effective cyber risk management—but finance managers who embark on this journey will soon discover the Great Cybersecurity Exception. According to conventional wisdom in IT security circles, cyber risks cannot be assigned the same type of dollars-and-cents valuation as other risks because cyber risks are too technical and too dynamic, and historical data is too hard to find. Instead, cybersecurity professionals are often satisfied with designating cyber risks either red, yellow, or green on a heat map, based on their best guesses. Or they might show the progress they've made in reducing cyber risks by checking off tasks on a best-practices checklist like the NIST Cybersecurity Framework.