As the new year begins, CISOs gather with their security teams and corporate management to scope out top priorities for 2024 and how to address these issues. This year — with a multitude of new privacy laws, Securities and Exchange Commission regulations, cyber threats, and new technologies promising to solve those threats — they might be losing sleep trying to optimally stack the proverbial Tetris pieces of the cybersecurity strategy.
Of all the challenges vying for the CISO’s attention, the personal and legal responsibility for data breaches the SEC has placed on CISOs could be the most challenging in the new year, says Nicole Sundin, chief product officer at Axio. “With CISOs being elevated to the boardroom to discuss these risks, they will need a system of record to protect themselves and demonstrate duty of care,” she notes.
“Currently, CISOs have these conversations, make difficult choices, and act as they see necessary — but these may or may not be documented,” she says. “By having a single source of truth or a system of record, CISOs can better protect themselves. Otherwise, we will continue to see high-profile incidents where a CISO who doesn’t have this [record of events and why they were taken] in place takes the fall.”
1. Defend Yourself Against Personal Liability
Sundin likens CISOs to healthcare executives, who keep detailed records of every action they take in order to defend themselves against claims of malfeasance. Considering that many CISOs are not covered under corporate directors and officers (D&O) insurance policies, they would be liable personally under new SEC rules should a breach occurs. That includes personal liability for both a breach with data loss or a privacy breach without data loss.
Sundin recommends that CISOs take the following steps as soon as possible:
-
Create a system record. It can be a planner or diary where every action relating to a potential security incident is recorded with a detailed, chronological description of each action taken and the reasons why they were taken.
-
Create a corporate definition for “materiality,” with input from the general counsel or the chief risk officer, to establish clear guidelines for what is legally considered materially significant to investors or shareholders and what is not.
-
Learn to speak to the board of directors and other executives in financial terms. Tell the board exactly which security controls are required, their cost, and the potential loss to the company if a breach occurs due to not having the security controls in place.
CISOs must also be active participants when negotiating cyber insurance policies, Sundin says. Normally CISOs need to sign off on what the general counsel or CFO ultimately negotiates, but without having direct input — with a written record of their recommendations — they could become legally liable protecting a non-insurable exclusion.
2. Monitor Emerging Privacy Threats
Cyber insurers will focus on privacy breaches in 2024, predicts David Anderson, vice president of cyber liability at Woodruff Sawyer, a national insurance brokerage. Anderson says cyber insurance underwriters are expected to harden regulations on how organizations implement security on private data and privileged accounts, including service accounts, which he notes, tend to be overprivileged and often have not had their passwords changed in years.
“If you are not adhering to the privacy laws and statutes that are applicable to your business, to your jurisdiction, to which your reasonable standard applies, we’re not going to cover the fact that you are sharing data in a way that’s not aligned with your privacy policy or is not aligned with statute,” Anderson says.
Citing the tightening privacy laws in states such as California and Washington, he says cyber insurers are demanding organizations not only have comprehensive privacy policies in place, but be able demonstrate that they follow their policies. If organizations fail to protect data protected by their privacy policy, they could find themselves without the coverage.
“It might be an uninsurable risk,” he says. “Those claims are horrifically expensive from a defense and settlement perspective.”
“The underwriter is going to look for more than just a yes or no checkbox [on a cyber insurance application]. You are going to have to show where these controls are embedded [and] where you’re forcing your vendors to adhere to the same level of care” as your organization’s privacy policies dictate, Anderson warns.
3. Manage Third-Party Risks
While privacy threats will be high on board of directors’ priorities for 2024 thanks to the new SEC regulations and cyber insurers’ requirements, so too will other supply-chain threats. Alastair Parr, senior vice president of global products and services at third-party risk management (TPRM) provider Prevalent, says organizations should build their procurement programs by identifying partners from the perspective of: How can this third party offer operational resilience benefits to us?
Forward-thinking visionaries look at third-party risk management (TPRM) and data in the aggregate and what data breaches mean based on emerging and expanding regulatory compliance, said Parr. Rather than focusing on the data itself, he suggests taking a holistic approach, calling it a cross-functional supplier risk management framework.
“As soon as the board starts thinking about it as cross functional, a more comprehensive program — more of a lifecycle — that changes the questions they should be asking,” he says. “They should be getting excited about the procurement involvement. They shouldn’t be scared of data for data’s sake.”
The vast majority of companies today are struggling with TPRM, Parr says, because they focus more on the cost of data governance than on regulatory compliance, operational resilience, brand impact, or the reputational risk associated with data breaches.
Looking Ahead
In the environment of increased regulation, CISOs are now held personally liable for data breaches, regardless of whether they involve data loss or privacy violations. In response, cyber insurance underwriters are tightening their rules on how organizations should protect private data and privileged accounts. And all of this is happening with increased attention from regulators, insurers, and the C-suite to supply chain threats.
To meet these challenges in the coming year, CISOs need to protect their organization and themselves by creating a system to document relevant actions and decisions, establishing and enforcing comprehensive and consistent privacy policies, and assessing their third-party partners in terms of operational resilience.
By working across the organization with procurement, legal, and security teams, CISOs can mitigate the potential impact of supply chain threats and insurance costs on their business — and cover themselves too.
