We use cookies to give you the best online experience. By using our website you agree to our use of cookies in accordance with our cookie policy. Learn more here.Close Me
Does your board exercise proper oversight over cybersecurity
risks? Directors and officers have fiduciary duties to protect
the assets of their companies. This obligation covers digital
assets, including corporate information, applications, and
networks. The scope of the obligation is defined, in part, by laws
and regulations that impose specific privacy and security
obligations on companies.
The report, How Boards & Senior Executives are Managing
Cyber Risks, is based on a survey conducted by Carnegie Mellon CyLab. This is the third
survey that CyLab has conducted and its findings reveal that, for
many companies, boards do not have sufficient information to
properly oversee the management of cybersecurity risks.
CyLab identified the following areas as specifically
lacking:
Reviewing budgets, security program assessments, and top-level
policies;
assigning roles and responsibilities for privacy and
security;
and receiving regular reports on breaches and IT risks.
The report also noted that little attention is focused on risks
related to vendor management and observed:
the low response for vendor management is concerning because it
indicates that the privacy and security of data at cloud and
software providers and outsource vendors are receiving little
oversight.
In comparing findings across industries, CyLab found that the
financial sector has some of the strongest privacy and security
practices in place, while energy and utilities had some of the
weakest governance practices.
The report concludes with a set of recommendations to boards and
senior management. These recommendations include:
"Review existing top-level policies to create a culture of
security and respect for privacy. Organizations can enhance
t
heir reputation by valuing cyber security and the protection of
privacy and viewing it as a corporate social
responsibility."
"Review assessments of the organization's security
program and ensure that it comports with best practices and
standards and includes incident response, breach notification,
disaster recovery, and crisis communications plans."
"Ensure that privacy and security requirements for vendors
(including cloud and software-as-a-service providers) are based
upon key aspects of the organization's security program,
including annual audits and control requirements. Carefully review
notification procedures in the event of a breach or security
incident."
"Require regular reports from senior management on privacy
and security risks."
"Require annual compliance audits and test incident
response, breach notification, disaster recovery, and crisis
communication plans."
Data breaches, and loss of user data and other sensitive
information, pose significant legal and reputational risks for
companies. All companies should ensure that they have the systems
and policies in place to manage risks to digital assets. These
systems need to be regularly evaluated and properly resourced: this
requires top-level attention from senior management and the
board.
To view Foley Hoag's Corporate Social Responsibility
Blog please click
here
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
The 2010 theft of an unencrypted laptop containing confidential health care information made front-page news in 2013, not because a huge number of patients were affected, but for the exact opposite reason.
Identity theft is a serious threat. In 2012, more than 12.6 million adults became victims of identity theft in the U.S.1 And the costs have been astronomical.
On April 22 Verizon released its 2013 Data Breach Investigations Report (DBIR), which has since 2008 become a leading annual survey of data breaches, with participants across the globe.
Increasingly, privacy is a big concern in app development. California and other jurisdictions are ramping up enforcement efforts around existing privacy laws.
Understanding the complexities of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules is often a challenge for health care providers and consumers.
Any company that collects personal data from consumers should take proactive steps to have appropriate legal counsel review its data security practices, as well as its terms of service or privacy practices, to identify any potential problem areas.
The U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) published on its website a series of factsheets designed to educate consumers unfamiliar with their rights under the Health Insurance Portability and Accountability Act’s (HIPAA) Privacy and Security Rules.
FTC On The Prowl, And Businesses Looking For Guidance On New COPPA Changes
