Call us now:
This is a great read. A research paper that discusses the role of cyber insurers and attorneys in the incident response process. Written by 4 respected cyber academics, Daniel Woods, Josephine Wolff, Daniel Schwarcz and Rainer Bohme.
Now accepting that cyber, cyber insurance and risk research is limited, the paper does a nice job in examining the incident response process and the role of 2 key players, the insurers and the lawyers. Ones favorite section 5, how lawyers shape the IT process is worth reading. Why?
One has to ask the question of the role of insurers and attorneys as cyber regulation finalizes and shifts cyber left of bang into board rooms. Cyber risk regulatory reporting will become mandatory ex-ante risk assessment, mitigation and reporting. The data companies would normally collect post breach will in part be required for boards to demonstrate cyber regulatory compliance ‘Left of bang’, just more of it (just take a look at a CSF profile).
Hypothetically, one wonders the effect on the attorney client relationship with the introduction of cyber regulatory compliance. More over if a cyber incident takes place and a regulator questions the data provided ex-ante, related to the effect of the cyber incident?
With U.S and EU regulation requiring boards to report and attest cyber compliance, with potential civil and criminal liability (EU NIS 2). What will become of all the information that was assessed prior to regulatory reporting. Could General Counsel decide not to report it; what happens to members of the board if that is the case; what happens in the event of a cyber incident and what is the difference between cyber regulatory reporting and Sarbanes Oxley reporting? Attesting cyber risk management compliance creates allot of data and regulators such as the SEC and NYDFS already know what data is required.
One suspect these questions will be pondered by the legal community and boards over the coming months as EU and U.S cyber regulation and reporting formalizes.
Ted Dziekanowski Rachel V. Rose, JD, MBA Stephen Pitt-Walker, JD, FGIA
#cyberregulation #cybersecurity #cyberriskmanagement #cyberlegal
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7072269568232042496