Call us now:
Cyber is not solely a CISO ‘problem’ to resolve and one does not believe there should be any conflict of interest between the CISO and GC. Cybersecurity ceased being solely a CISO problem when regulators introduced cybersecurity regulations such as the SEC final rule, EU NIS 2 and DORA. Regulation that shifted cybersecurity risk management into the board rooms of covered entities. At the same time introducing legal and compliance risks directly on accountable directors and executives.Cybersecurity professionals should be aware that cyber is a legal and compliance issue to resolve. By definition is requires a close working relationship across all three lines of defense and General Counsel. For covered organisations cyber is a board room problem, as boards at a minimum should demonstrate their oversight, assurance of cyber risk ahead of attestation. Changing the paradigm through which management teams, executive leadership, including CISOs, demonstrate their management of cyber risk.One should remember that the ultimate backstop for cyber risk for some companies could well be regulatory compliance, and regulatory compliance is a domain led by the Chief Compliance Officer, or legal council. Security professionals that make a decision to take responsibility for the legal process maybe treading on dangerous ground; may find themselves causing more damage than they resolve; they are not impartial in their role and could damage the chances of an organisations ability to demonstrate compliance or remediate actions following legal actions. They could find themselves in court (Uber, SolarWinds), a place no one wants to go to.@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan Rachel V. Rose, JD, MBAVeritas GRC#cybersecurity #cyberriskmanagement #cyberregulation #legalcyber
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7295373823091048448