McKinsey Classics | March 2023

Not all systems and data are created equal

Some systems and data are more important than others. Some are more exposed to risk. And some are more likely to be targeted by criminals. In a digitized world, it’s hard to protect everything equally well.

Different sectors of the economy have different critical assets. For hospitals, the most sensitive thing is typically information on patients. Aerospace companies must above all guard their intellectual property. Financial-services firms are vulnerable to fraudulent transactions, and their M&A databases need the best protection money can buy.

Most large companies now recognize the severity of cyberthreats. But they tend to treat these risks as a technical issue, not a business problem, so that the needs of the enterprise as a whole are often lost. To put those needs front and center, business units should collaborate with the cybersecurity, IT, and risk functions to determine which information assets are priorities for the entire company, how likely they are to be attacked, what should be done to protect them, and who the likeliest attackers might be. Likewise, any subsequent action should take place on a company-wide scale.

To learn more, read our classic 2017 article “Protecting your critical digital assets: Not all systems and data are created equal.”

— Roger Draper, editor, New York