Call us now:
The Uber CSO case has come to a conclusion with the ex-CSO receiving 3 years probation and a $50,000 fine. It brings to an end what is a distressing time for Mr. Sullivan, a clear problem for Uber, and precedence setting for the legal and cyber community. When asked yesterday by the judge William Orrick what he would do differently, Mr Sullivan responded.
‘he would have sought the opinion of outside counsel.’ After prompting from the judge, he added that ‘he would have consulted with corporate general counsel.’
The judge sent a clear message yesterday, that if another case crosses his bench the outcome would be different. But if I have a similar case tomorrow, even if the defendant had the character of Pope Francis, they would be going to prison,. Stressing that the sentence hearing was not about bad calls made during the heat of a responding cybersecurity incident.
Where does this case leave the cybersecurity profession? In ones opinion with the amount of cyber regulation coming through the U.S and EU, it places covered boards and the security profession in a challenging position, as cyber matures into a professional, accountable board role. At the time Uber did not face cyber any dedicated cyber regulation, todays cyber professional will. Regulation that sets a bar for regulatory compliance and civil and criminal conviction, if boards and CISOs are unable to demonstrate a reasonable level of cyber risk compliance.
In ones opinion new regulation requires boards and CISOs to adopt a 3 line model for cyber compliance, one tested over the past 20 years by the Financial Services industry. A model that brings together legal, audit, risk and cyber through corporate governance to demonstrate an adequate level of cyber compliance. As cyber regulation shifts cyber risk management ‘Left of Bang’ into the board room, boards must recognise that they cannot secure everything. But they will have to demonstrate that they have taken reasonable and best efforts to manage cybersecurity risks.
Cyber regulatory compliance is the reason we built the cyber risk management governance model. If you would like to discuss then please reach out (https://lnkd.in/eVgsGpyx)
Ted Dziekanowski Rachel V. Rose, JD, MBA Stephen Pitt-Walker, JD, FGIA Jamie Foster
#uber #ciso #cybersecurity #cyberriskmanagement #cyberregulation #cyberlaw
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7060148135657889793