Call us now:
A great article that is well worth reading, bringing together cybersecurity, regulation and litigation. The regulatory landscape for cybersecurity is developing at a rapid rate. The SEC recently released a cybersecurity proposal, the DoD CMMC program requires DFARS compliance, there is GDPR, HIPPA, EU-NIS and 23 NYCRR 500.
Regulation that will have good and bad consequences for cybersecurity professionals. Bringing their own risks and increasing legal and litigation exposure to companies and their CISOs. Cyber attacks and data breaches are drawing law suits that are increasingly focusing on shareholder compensation and cybersecurity compliance, and if CISOs become directors of organisations then they may well be the target of direct legal action, as illustrated by the SolarWinds hack.
My fear is that while legislative changes create opportunities for cybersecurity in the board room. The pace of legislation will not give security professionals the time to put in place appropriate cybersecurity management and expose them to increased legal risk. Companies will have to demonstrate cybersecurity compliance and CISOs may have to explain how cybersecurity risk was or was not managed ahead of a cyber attack, whose cost to shareholders could be measured in $Millions or $Billions.
CISOs now need to work on ‘left of bang’, focusing on risk and compliance. Going forward shareholders and regulators will care more about how well a company manages cybersecurity and regulatory compliance, than how well the incident was managed.
Cyber regulations and regulatory enforcement programs (DoJ, DoT) maybe game changers for many reasons. But they create compliance challenges that are better addressed ahead of litigation?
Ted Dziekanowski
#cybersecurity #ciso #cyberriskmanagement #legalrisk #cyberlaw #cyberlegal
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6923173615517495296