The legal risks associated with cybersecurity risk management.

← Back to Blog

The legal risks associated with cybersecurity risk management. In this case Mastagni Holstedt a California law firm is suing its MSP and its owners following a cyber attack. That effected the law firm in February 2023, forcing it to pay the hackers.

One wonders how easy this case will be to resolve; as it is reported that the law firm and MSP entered into an oral agreement to provide monitoring services, cloud backup and advice on selling software and hardware. If there is no written contract defining the services offered and received how easy will it be to determine liability?

“What this [lawsuit] brings to light is a common thing that I see in the industry is you’ve got MSPs that know technology very well and businesses that know their business well but don’t know technology,” he said. “There’s a big difference between the delivery of technology and the delivery of cybersecurity.”

What the case highlights are challenges MSPs and their clients face ensuring they confirm the products and services they require and and contracts clearly define what is being provided. Many cloud service providers and their client more often do not not understand what they are getting or their obligations. The shared responsibility model adopted by Azure and AWS for example sets out cybersecurity requirements for the cloud vendor and customer. Placing responsibilities on the customer to manage cybersecurity.

As an adjunct, the EU is regulating MSPs to manage cybersecurity risks through EU NIS 2 and DORA. Regulation that will flow up and down, to and from their clients. Forcing both to be clear about their accountabilities and responsibilities for cybersecurity risk management.

@Thaddeus Dziekanowski Brian D. McCarthy Rachel V. Rose, JD, MBA

Veritas GRC

#cybersecurity #cyberriskmanagement #cyberinsurance #defense

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7180841340379787264