I’m concerned that we’re still having the conversations.

← Back to Blog

I’m concerned that we’re still having the conversations. The biggest issue facing CISOs is cyber regulation. Regulation that is coming from the U.S and EU, has civil and criminal liabilities attached.

The SEC final rule requires boards to manage material cyber risk and report material cyber incidents and CISOs are considered accountable executives. EU NIS 2 and DORA expects boards to demonstrate that they manage cyber risk and report cyber incidents in 24 hours and again the CISO is an accountable executive.

The assessment of control effectiveness, will be in line with risk management practice and covered entities will be required to demonstrate adequate compliance to regulators. CISOs can never be independent, not when boards have to attest cyber risk to shareholders. Boards carry fiduciary responsibly for their decisions and the management of cybersecurity risk, so will CISOs.

A question: Why are CISOs not accountable for their decisions, if boards have to comply with cyber regulation?

A further question: Can D&O and cyber insurance be relied upon to fully cover executives, including CISOs, if regulation is not complied with?

Ted Dziekanowski Brian D. McCarthy Bob Dix Rachel V. Rose, JD, MBA

#paravasecuritysolutions #cybersecurity #cyberriskmanagement

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7121543990557974528