Cybersecurity Leadership Principles From the COVID-19 Crisis

Why the paper was written

The World Economic Forum published “Cybersecurity Leadership Principles: Lessons learnt during the COVID-19 pandemic to prepare for the new normal” in May 2020, in the first months of the pandemic. Its premise is that what would normally take years of digital change had happened in months, and that this exposed weaknesses where digital infrastructure, the economy, geopolitics and privacy meet.

It lists six pressures. Remote work widened the attack surface through personal devices and home networks. Social engineering stayed effective against a distracted workforce. Highly connected supply chains became harder to keep resilient. New, mostly cloud-based services were launched fast enough that risk checks could be skipped. Critical assets were more exposed to criminals and state actors. And essential services such as hospitals came under pressure, with ransomware aimed at disrupting vital care.

Principle 1: Foster a culture of cyber resilience

The paper’s first claim is that focusing only on security is not enough. Organisations also need resilience, meaning the ability to absorb an attack and recover, and that is set from the top. It recommends four actions. First, governance: the board takes oversight responsibility and an accountable officer breaks down walls between business, IT, operational technology and physical security. Second, resilience by design, which means managing cyber risk from the start of IT and business changes, mergers and third-party relationships, when fixes are cheapest.

Third, go beyond compliance. Because threats change faster than regulation, a check-the-box approach is not enough; during the crisis, firms may need to work with regulators on a reasonable timeline for restoring their compliance position. Fourth, strengthen employee behaviours: staff decisions matter as much as technical controls. The paper notes that phishing surged during the pandemic, including scams that impersonated the World Health Organization, and recommends regular training, least-privilege access and stronger anti-malware and anti-phishing tools.

Principle 2: Focus on protecting critical capabilities and services

Leaders need a whole-system view of services, applications, suppliers and assets so they can see what a crisis would do to revenue, staff, customers and essential services. The paper makes an analogy with human health: prevention, tracing and response measures for a virus parallel those for digital threats.

Its four actions are: strong cyber hygiene, starting with an inventory of digital assets and the critical ones first, since exploiting known vulnerabilities is a common way in; protecting access to critical assets with stronger identity and access management, network segmentation, strong authentication, automated provisioning and revocation of access, layered access for privileged users, and remote connections protected with multi-factor authentication; monitoring abnormal activity to shorten the time from detection to mitigation, including watching collaboration tools, new malware strains, and employee and third-party behaviour; and investing in automation, such as AI and machine learning, to handle routine security tasks and reduce human error so people can focus on response and preparedness.

Principle 3: Balance risk-informed decisions

Organisations were changing operating models and technology at unusual speed, which meant accepting risk trade-offs. The paper says leaders should expect to restore their risk position to an acceptable level once the emergency passes. It offers three actions: move towards a zero-trust approach to the supply chain, because attackers look for the weakest link and fast-moving software, open source and cloud platforms make unresolved flaws common (it points to scrutiny of security and privacy flaws in a video-conferencing tool as an example); define meaningful resilience metrics, aligned to business goals and covering detection, response, containment and recovery, perhaps in a dashboard of critical dependencies; and focus on the cyber risks that matter most to operations, prioritising technologies and rollouts critical to the business.

Principle 4: Update and practise response and continuity plans

Crisis planning is treated as a core part of business continuity, where a major incident is a matter of when, not if. The paper advises building a cross-functional crisis team and a detailed plan covering tools for case management and internal communication, plus key contacts in government, law enforcement, legal and insurance.

It then asks leaders to test and improve incident response, disaster recovery and continuity plans against both cyberattack and pandemic scenarios, balancing protection with response and recovery. Looking beyond the crisis, it expects remote work to continue, with secure cloud-powered remote technology balancing security, user experience, cost and efficiency, and expects digitalisation, driven by AI, cloud computing and the internet of things, to keep accelerating.

Principle 5: Strengthen ecosystem-wide collaboration

No single organisation sees every attack, so the fifth principle is about collective defence. The paper urges real-time, transparent information sharing across the public and private sectors, with attention to national security limits, and says regulatory protection for victims who share information about incidents would encourage sharing. It also stresses knowing which government agencies and personnel to contact in each jurisdiction.

It asks organisations to go beyond subscribing to threat feeds and take part in industry groups that coordinate against criminal and state-linked actors, naming the Cyber Threat Alliance, the CTI League and the COVID-19 Cyber Threat Coalition as examples. Finally, it calls for a systemic view: every connected device is a potential entry point, so the ecosystem should be mapped by dependencies, supply-chain cyber risk should be quantified, and suppliers should be held to aligned expectations.

How we read it today

Written in 2020, the paper is a snapshot, and it calls itself a preliminary response to a fast-moving crisis. But its core points travel well to the topics on this site. Connected devices in the internet of things and cloud services expand the attack surface the paper worries about. Identity and access are central, which is why wallet-based sign-in ideas such as Digi-ID are worth examining. And the supply-chain and collaboration themes echo the shared-ledger and trade-data discussions in our TradeTech and NATO explainers.

The paper does not give a control checklist or maturity model, so use it to frame the leadership conversation and then turn to a formal standard or your regulator’s guidance for specifics. Our cyber security topic page collects the wider concepts and links.