CFO Cyber Risk Guide: Payment Controls, Insurance, Disclosure and Security Spend

The chief financial officer owns more of an organisation's cyber risk than most org charts admit: the payment process that fraudsters target, the internal controls that auditors test, the insurance that transfers part of the loss, the disclosures that regulators read and the budget that pays for defence. This briefing sets out that accountability for CFOs, finance directors and the audit and risk committees that oversee them. It covers payment control ownership, IT controls inside financial reporting, the retain or transfer decision, the CFO's place in incident disclosure and how to fund security against risk rather than against last year's number. It does not repeat staff awareness training for finance teams, which is in the Business Email Compromise Awareness for Finance Teams Guide, or the quantification method itself, which is in the Cyber Risk Quantification Executive Briefing.

The risk in one paragraph

Cyber incidents reach the CFO in five ways: money leaves through a manipulated payment, a control that the financial statements rely on turns out to be ineffective, an incident costs more than the balance sheet planned to absorb, a disclosure is late or inaccurate, or security spending is either too thin to manage the agreed risk or too scattered to show what it bought. The FBI's Internet Crime Complaint Center recorded 21,442 business email compromise complaints in 2024 with losses of about $2.77 billion, out of $16.6 billion in total reported losses. Each of the five routes is a finance process with an owner, a control and evidence. The CFO's job is to make sure those owners exist, that the controls are designed for an adversary rather than an honest mistake, and that the board receives numbers it can act on.

Why this is a board-level issue now

• Controls declarations now include cyber: the 2024 UK Corporate Governance Code asks boards to declare that their material internal controls are effective, covering operational, compliance and reporting controls. The FRC states that Provision 29 applies to financial years beginning on or after 1 January 2026, and that which controls are material is for each board to determine. For most companies, access to the finance systems, backup and recovery of the ledger, and the payment release process are strong candidates.
• Disclosure clocks run from a finance judgement: SEC registrants must file Form 8-K Item 1.05 generally within four business days of determining that a cybersecurity incident is material, and describe cyber risk management, board oversight and management's role annually under Regulation S-K Item 106. Materiality is a judgement finance leaders make every quarter. See the SEC Cybersecurity Disclosure Rules Guide.
• Directors are told to fund cyber against risk appetite: the UK government's Cyber Governance Code of Practice, published 8 April 2025, asks boards to define and communicate cyber risk appetite (A3) and to gain assurance that resources, including budget and staffing, are allocated effectively to manage the agreed risks (B3). That is a budgeting instruction. See the UK Cyber Governance Code of Practice Guide.
• Insurers reprice on declared controls: the UK NCSC warns that if an organisation claims security measures are in place when they are not, the insurer may not be obliged to pay. The CFO usually signs the proposal form.
• Auditors look at the IT under the numbers: PCAOB AS 2201 requires auditors to understand how IT affects the flow of transactions and treats reliance on IT general controls as a factor in control risk. A cyber weakness in access to the ERP can become a control deficiency.

The five areas the CFO owns

Payment controls: designing for an adversary

Traditional finance controls assume an honest employee who might make a mistake. Payment fraud assumes an attacker who controls an email account, a supplier's mailbox or a voice clone, and who will push an approver to bypass the process. The CFO's lever is policy: the process rules that staff can point to when someone senior or urgent asks them to break it.

• Beneficiary changes: no change of supplier bank details takes effect on the strength of an email or a call received. Verification uses a contact number already held on file, by someone other than the person who received the request, and the change is held for a cooling-off period before the first payment.
• Payment release: dual control above a threshold, with the second approver seeing the beneficiary history, not just the amount. Thresholds are set so that splitting payments is visible.
• Urgent and confidential payments: a written rule that no request, including one that appears to come from the CEO or CFO, overrides verification. The CFO should say this publicly to the finance team, because it is the CFO's name that fraudsters use.
• Segregation of duties: the people who create suppliers, change bank details and release payments are different, and the ERP enforces it. See the Segregation of Duties Guide.
• Recovery readiness: the bank's fraud line, the account manager and the national reporting route are in the payments runbook. The FBI reports that its Recovery Asset Team's Financial Fraud Kill Chain froze funds in 66% of the 2024 cases it acted on, and asks victims to report as quickly as possible. Speed after the transfer is a control. See the Payment Fraud Guide.

The deepfake and authorised push payment angles are covered in the Deepfake and Payment Fraud Executive Briefing.

Where identity fits: the machine side of finance

Most money now moves without a person pressing a button. Payment files travel from the ERP to the bank over host-to-host connections, treasury platforms call banking APIs, and integration service accounts post journals between systems. Each of these runs on a non-human identity: an API key, a certificate, an SFTP key or a service account password. If one is stolen, an attacker can create or alter payments without passing any of the human approval steps above.

• Ask for an inventory: every credential that can create, approve or transmit a payment, who owns it and when it was last rotated.
• Treat payment-capable credentials as privileged: vaulted, rotated, scoped to the minimum and monitored, in the same ITGC scope as human administrator access.
• Close the offboarding gap: credentials created by contractors and implementation partners are revoked when the project ends.

See the ERP platform integration security guide and, for bank messaging, the SWIFT Customer Security Programme Guide.

Internal control over financial reporting

For US issuers, the CEO and CFO certify the financial statements and management assesses internal control over financial reporting under the Sarbanes-Oxley Act; in the UK, Provision 29 brings a similar board declaration for material controls. In both, cyber shows up as IT general controls: who can access financial systems, how changes reach production and how operations, including backup, are run. AS 2201 notes that automated controls can be relied on with less testing only when general controls over program changes, access and computer operations are effective.

The practical step is to agree with the CISO and internal audit that cyber controls over financial systems are tested once, to one standard, for both the security programme and the controls attestation. See the SOX IT General Controls Guide.

Retain or transfer: the insurance decision

The CFO decides how much cyber loss the organisation keeps. Insurance only makes sense against a modelled loss: a few severe but plausible scenarios, each with a financial range, set against the retention, the limit, the sub-limits and the exclusions. Three points need the CFO personally:

1. Payment fraud cover: NCSC notes that some policies do not cover money lost to business email compromise. If payment diversion is a top scenario, confirm the wording, the sub-limit and any verification condition attached to it.
2. The proposal form is a finance document: each control answer needs a named owner and evidence, and changes during the year are notified. NCSC states that policies are typically reassessed every 12 months and the organisation is responsible for keeping security details accurate.
3. Retention is a balance sheet choice: a higher deductible saves premium only if the business can fund the retained loss during an outage, when revenue may also be falling.

Policy mechanics are in the Cyber Insurance Executive Briefing and the Cyber Insurance vs Self-Insurance guide.

Disclosure: the CFO in the room

An incident becomes a disclosure question the moment someone asks whether it is material. For SEC registrants, the four business day clock in Item 1.05 starts at the materiality determination, not at discovery, so the process for reaching that determination must be fast and documented. Item 1.05 requires a description of the material aspects of the incident's nature, scope and timing and its material or reasonably likely material impact. The only delay mechanism in the rule is where the US Attorney General determines that disclosure poses a substantial risk to national security or public safety.

• Disclosure committee: the CFO, general counsel, CISO and investor relations meet on a defined trigger, with the CISO bringing facts and finance bringing the quantitative and qualitative impact assessment.
• Financial effects: response costs, lost revenue, impairments, contingent liabilities and insurance recoveries all need accounting treatment and may need disclosure in the period.
• Consistency: what the annual Item 106 description says about risk management and board oversight must match what the organisation actually does. Overstated maturity is a disclosure risk.

The board-level view of SEC disclosure is in the SEC Cyber Disclosure Executive Briefing; legal handling of the same decision is in the Security for General Counsel Guide.

Security spend: funding against risk

A security budget set as a percentage of IT spend tells the board nothing about whether it is enough. The Cyber Governance Code links resourcing directly to the agreed risk appetite. NIST IR 8286 Rev. 1, published December 2025, describes how cybersecurity risk registers feed enterprise risk management, which gives the CFO a common currency for comparing a security investment with any other use of capital.

See the Cyber Security Investment Executive Briefing and the Risk Appetite and Tolerance for Cyber Guide.

Where it sits in the frameworks

Five questions for the board to ask

• Payments: can any single person, or any single credential, change a supplier's bank details and release a payment to the new account?
• Controls: which cyber controls have we treated as material for the controls declaration or certification, and what did the last test find?
• Retention: for our three worst plausible cyber scenarios, how much would we pay ourselves, and could we fund it during an outage?
• Disclosure: who decides materiality after an incident, how fast can they meet, and when did we last rehearse it?
• Spend: which named risks would rise above appetite if the security budget were cut by 10%?

Red flags in management answers

• Bank detail changes are verified by replying to the requesting email.
• Payment integration credentials are "managed by IT" with no named owner or rotation date.
• The insurance limit equals last year's limit, with no scenario behind it.
• The materiality process exists only as a paragraph in the incident response plan.
• The security budget is reported as a total, not against risks.

What good looks like

Payment rules are written, enforced in the ERP and owned by the CFO. Every credential that can move money is inventoried, privileged and monitored. ITGCs over financial systems are tested once and used by both security and audit. The retention decision is based on scenarios and recorded. The disclosure committee has rehearsed a cyber materiality call. Security spend is reported against the top risks and appetite, with waste removed before increases are requested.

Where to invest first

1. Out-of-band verification and cooling-off for beneficiary changes, enforced in the system.
2. MFA and privileged access controls on ERP, treasury and banking portals.
3. Inventory, vaulting and rotation of payment-capable machine credentials.
4. Tested, isolated backup of the ledger and payment systems.
5. A rehearsed disclosure and insurer notification process.

Metrics to track

• Verification compliance: percentage of beneficiary changes with documented out-of-band verification (target 100%).
• Fraud outcome: attempted fraudulent payments stopped before release, and value recovered after release.
• Machine credential hygiene: percentage of payment-capable credentials with a named owner and rotation within policy.
• ITGC deficiencies: open cyber-related control deficiencies over financial systems, by severity and age.
• Risk coverage: share of security spend mapped to the top ten risks.
• Disclosure readiness: time from incident escalation to materiality decision in the last exercise.

Board-level reporting format is covered in the Board Cyber Risk Reporting Guide.

A 90-day plan

1. Days 1 to 30: map the payment process end to end, including every system and credential that can create or transmit a payment; review the beneficiary change rule; list the cyber controls in scope for certification or the controls declaration.
2. Days 31 to 60: fix the highest-risk payment gaps; agree with the CISO and internal audit a single test plan for financial system ITGCs; build three loss scenarios and set them against the insurance programme.
3. Days 61 to 90: run a tabletop with the disclosure committee that includes a fraudulent payment and a ransomware outage over the close; present spend against risk to the audit or risk committee with the decisions needed.

Common failure patterns

• Training without process: staff are taught to spot fraud, but the process still allows a single person to change bank details.
• Human controls, machine bypass: dual approval in the ERP, while an unmonitored integration key can submit payment files straight to the bank.
• Two control sets: security and audit test the same access controls differently and reach different conclusions.
• Insurance as strategy: a policy bought in place of controls, with a payment fraud sub-limit nobody read.
• Late materiality: the decision waits for forensic certainty, and the disclosure is then rushed.

Practitioner checklist

• Write and publish the CFO's payment verification rule, including that no executive request overrides it.
• Enforce segregation of duties for supplier creation, bank detail changes and payment release in the ERP.
• Inventory every machine credential that can create, approve or transmit payments, with owner and rotation date.
• Agree which cyber controls are material for certification or the Provision 29 declaration.
• Run one ITGC test plan shared by security and internal audit.
• Base insurance limits and retentions on documented scenarios; assign owners to proposal form answers.
• Name the disclosure committee and its trigger, and rehearse a cyber materiality decision each year.
• Report security spend against top risks and appetite, at least quarterly.

Standards and references

• US SEC: SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies
• Financial Reporting Council: UK Corporate Governance Code
• PCAOB: AS 2201 An Audit of Internal Control Over Financial Reporting
• UK Government: Cyber Governance Code of Practice
• NIST: IR 8286 Rev. 1, Integrating Cybersecurity and Enterprise Risk Management
• FBI IC3: 2024 Internet Crime Report
• NCSC: Cyber insurance guidance

How NHI Mgmt Group can help

We help finance and security leaders find and govern the machine credentials that move money, from ERP integration accounts to banking API keys, and we provide independent board briefings on identity and non-human identity risk. Our NHI Foundation Level Training Course helps IAM and security teams manage service accounts, API keys and secrets. Contact us to arrange a briefing.

Related NHI Mgmt Group resources: Business Email Compromise Awareness for Finance Teams Guide · Cyber Risk Quantification Executive Briefing · SOX IT General Controls Guide · Three Lines Model for Cyber Risk Guide