Be clear on cybersecurity
Five questions you will need to ask
27 April 2017
1. How will new laws impact us?
The cybersecurity legal landscape is evolving fast. Core policies (HR/data collection/confidentiality/business continuity/insurance) must be redesigned with cyber in mind. You will need to ensure that your board is always alert to cyber risk issues and is able to react quickly. A new approach to data risk and compliance is now required to protect against reputational damage and significant new fines.
2. Are we addressing the cyber risk profile of suppliers?
Your valuable data should only be passed to vendors and suppliers who have been cyber-vetted. To back this up, new cyber protection clauses need to be integrated into your agreements. Can you be sure that your suppliers will tell you about a cyber attack before your customers read about it on the internet? Will they help you manage the fall-out and compensate you for your losses?
3. Is cyber a key part of our M&A due diligence?
When buying any business, cyber due diligence needs to be at the top of your list. Has the target fallen victim to a cyber attack? What risk mitigation measures are in place? Does the valuation reflect any cyber weaknesses?
4. What is our cyber disaster response plan?
An hour-by-hour cyber attack response plan is needed across the organisation, with business leaders, legal, IT, HR, IR and PR teams working as one. Your plan needs regular testing and review.
5. If we have a data loss incident, what will we tell regulators and customers?
One or more regulators may need to be notified following a data loss incident; in these circumstances you will want your legal adviser to have intimate knowledge of your risk mitigation strategy to put forward your best case. You may also need to tell customers – this legal communication process needs careful management.