Further depth on the Uber CSO case. While it maybe felt that the verdict is misplaced, maybe based on the historical perspective of the 2016€¦

← Back to Blog

Further depth on the Uber CSO case. While it maybe felt that the verdict is misplaced, maybe based on the historical perspective of the 2016 incident. The judge was clear and possibly lenient. Sending a message that won’t be the case going forward. The security community I am sure is pay attention to what is taking place for cyber security risk management and regulation. If security professionals feel that the role of the CISO is as a sacrificial officer, one should pay close attention to what regulators are planning and implementing. CISOs have a professional duty to support boards manage cybersecurity risks and boards have a duty report and manage those risks. The cyber profession is being professionalized, along side other important and professional roles so to be frank, ‘suck it up buttercup’

If CISOs want, need or are regulated to have a seat at the board table then the game needs to change for all. Boards will have to clearly demonstrate to regulators they understand, oversight, assure and attest cyber risks. Requiring more than just the CISOs input, it will require input from general counsel, audit, risk, compliance and finance to take responsibility and demonstrate compliance and manage legal risk. The Uber case is just a timely reminder that regulators and courts are taking cybersecurity compliance seriously; given the current state of cybersecurity and its impact on national, corporate and economic security. One should also consider the effects of this case and cyber regulation on D&O and cyber insurance. Cyber regulation shifts cyber risk left of bang to financial statements and reduces the effects on cyber insurance. D&O insurers may also be paying attention as they may not want to cover regulatory fines and legal fees in the event of a cyber incident.

As regulators set out compliance requirements for cyber that could likely be tested in court, the security community should not forget that they will be walking with their eyes wide open and should always be prepared to justify their actions both left and right of bang in front of a jury.

Ted Dziekanowski Rachel V. Rose, JD, MBA Celso De Azevedo FCIArb Stephen Pitt-Walker, JD, FGIA Jamie Foster

#cybersecurity #cyberriskmanagement #cyberlaw #governance.

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7060219682909249537