Call us now:
Thank you for posting Ted Dziekanowski. If cyber regulation moves ahead as predicted, it will create, regulatory, compliance and legal risk for boards. Risk that board members will have to carry individually and on behalf of their organizations.
You and I have written many times that the effect of cyber regulation will be to require boards to engage their internal and external legal, compliance, risk and regulation and cybersecurity experts and implement a 3 Line model for cyber governance, oversight, assurance and attestation. (https://lnkd.in/eVgsGpyx)
For CISOs regulation presents a conundrum. The role may provide a seat at the board table and it should make the role a Director or Officer of the firm. It will cement the role as the ‘accountable expert’ for the board and regulators, a role that changes the accountabilities and responsibilities of the CISO. At a time when most boards don’t understand cyber, don’t manage the risk, have not invested the necessary capital to manage the risk.
As a counsel appointed cyber advisory and expert to the ICO and a CISO I can appreciate in part the legal risk that the role and cyber regulation brings. It’s not going to be plane sailing and I wouldn’t recommend sitting across the table of some of the General Counsel and Barristers I know, unless I knew what I was getting myself involved in.
Here lies a medium term problem for industry, finding enough cyber expertise at time of increased regulation and a lack of cyber skills.
#cybersecurity #cyberriskmanagement #cyberregulation #legalrisk
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7072182114430939136