With the Government playing an increasingly proactive, and prominent role in cybersecurity, the Office of the Australian Information Commissioner (OAIC) taking a more aggressive approach, and the threat of business leaders being held personally liable in the event of a breach, now is the time for company board directors to follow suit and play a proactive role – but what does this really mean and where should they start?
What questions does the board need to be asking?
We are moving towards a threat and risk environment which requires greater leadership at board and leadership levels and demands a culture of continuous improvement. Now is the time for businesses in Australia, at a board level, to demand more accountability, due diligence and proactive measures to ensure organisations are secure from an IT perspective and that any security that relates to digital infrastructure is included in the safeguarding process.
Regulators expect boards to have the same level of confidence when overseeing cyber risk as with any business risk. In order to adequately understand, assess and challenge cyber and information security issues they need to ask the right questions. This includes understanding how the organisation is monitoring the changing cyber threat and regulatory landscape and the business’ ability to prevent, respond and keep pace with change. They also need to understand how the business is stress testing the right threats and how capable, confident, and ready to react the whole chain of response is, alongside how the business would communicate with stakeholders, in the event of a breach.
Boards need to be conversant with their data assets and risks and should seek out briefings from outside technical and legal experts if they are not deep experts themselves.
Ensuring sufficient financial investment
Robust cybersecurity requires a greater level of investment into robust security measures. With the stakes being higher than ever, it is essential to ensure the adequate level of investment is in place.
Last year, the OAIC filed a case in the Federal Court against ASX-listed Australian Clinical Labs (ACL) for failing to protect sensitive financial and health data. The OAIC highlighted that ACL had revenue of almost $1B in FY22, but only had $350K allocated for cybersecurity and argued this level of spend is completely insufficient given ACL’s turnover and the amount of sensitive data it handles.
The case is yet to be determined, but it highlights that there is such a thing as “too little spend”, and that a legal risk perspective may be quantified through this in future legal actions.
Ensuring the right people are in place
The digital landscape is moving at a faster pace than ever before and the board needs to continually remain ahead of the evolving landscape. Although cybersecurity has evolved beyond the remit of IT, it is critical to have an experienced and responsive CISO in place with the ability to speak to the business, translate cyber risk into material financial and business terms and impacts to make a case for adequate investment and drive the digital maturity of the business.
Research from Gartner found that by 2027, 75% of employees will acquire, modify or create technology outside the visibility of the IT department, up from 41% in 2022. This demonstrates the real need for CISOs to develop processes that enable risk-based decisions while protecting against security threats and preventing data breaches and other cybersecurity events, to ensure that areas outside of the IT department’s visibility are fully protected, at all times.
Working with your external legal counsel
Traditionally, a business would look to instruct its legal counsel once they have fallen victim to a serious cyber-attack or data breach. However, given the growing threat landscape and the potential for company directors to face personal liability, Australian businesses are increasingly reducing their risk appetite for cyber risks. The board and c-suite need to undertake a more legal strategic view of how the organisation controls its cyber posture and that its cyber prevention strategies are robust and defensible. Businesses today are required to move towards a considered and strategic approach to managing its cyber legal risks.
While a great deal of the preparatory work required to reduce legal risk associated with a cybersecurity incident is covered by existing cybersecurity best practices, there are a few considerations that can be overlooked in such unfocused efforts. Ensuring that incident response processes, contractual agreements, and governance structures are tuned to limit the risk of successful legal action by increasingly litigious regulatory authorities and customers helps safeguard the ongoing success of the business, while maintaining on-call access to forensic specialists enables appropriate legal action against malicious threats.
Involving external legal counsel and working with your internal counsel in the organisational cybersecurity maturity journey is a cornerstone component of a considered risk management approach, and the importance of such involvement will increase with time in light of the general regulatory trends Australia finds itself in.