Call us now:
Is the U.S Federal Government sending a message to CISOs in the U.S following the Uber trail, I don’t think so? The effects do not just impact U.S. CISOs, there’s always been a responsibility for the CISO to protect organisations, it’s just the goal posts have lit up. For Uber the case relates to a 2016 hack, but cyber has always been a complicated problem that has been largely ignored until the ‘bang’ and then everyone kicks into incident response and goes ‘well it wasn’t going to happen to me’, it just did.
CISOs have to be careful, regulators of public firms have for many years been clear about corporate obligations to manage and report material risks. Just because they haven’t enforced regulation doesn’t mean they won’t. As it stands today International firms listed on U.S capital markets will be impacted the proposed SEC cyber regulations. Regulations that could impact CISOs of these firms wherever they live, the SEC has long arms and the financial and political stakes are very high on financial markets.
Regulatory cyber proposals will place a significant burden on CISOs, and Boards. Requiring both to sort out cybersecurity risk management to a reasonable level, when the only test today is the court room. The shared responsibility model applies to more than just cloud. Shared responsibility applies to the relationship between boards and cybersecurity professionals, they both depend on each other to satisfy regulatory compliance.
There maybe no other choice. As a colleague once said to me ‘Suck it up buttercup’.
Ted Dziekanowski
#cybersecurity #cyberriskmanagement #cyberlaw #cyberregulation #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6986383214101573632