Key cyber issues for directors

As others have noted, there is no "one size fits all" approach when it comes to cybersecurity given that different sectors present different cyber risk profiles. Drawing on the governing standards, case law, and regulatory guidance, however, set forth below are 10 universal questions that directors might ask as part of their oversight of a company's cybersecurity program. In essence, these questions are geared at evaluating whether management has developed sufficient systems to identify and mitigate the particular cyber risks facing a company and has operational resiliency plans to ensure a comprehensive and prompt response to a cyber incident.

Who is responsible for organization-wide security preparedness? Companies should identify a senior person with clear responsibility for organization-wide security preparedness and ensure that the board regularly receives updates from this individual. This person is often a chief information security officer, but it does not need to be.
What resources have been allocated to address cyber risk? Management should evaluate the budget, staffing, and expertise needed to maintain a proper cyber risk program. This will depend on a variety of factors, including the industry in which the company operates.
Does our company have a sufficient written cybersecurity program? It is essential for companies to formulate a comprehensive, written data privacy and cybersecurity plan. This is one of the key aspects of any cybersecurity program. The plan should then be reviewed by, and distributed to, all individuals who may be involved in its execution and kept current as cyber risks evolve.
Are our employees sufficiently trained? Companies need to institute effective training programs that instruct employees on the appropriate handling and protection of sensitive data.
Have cyber systems at third-party vendors been closely scrutinized? Companies should take steps to mitigate the cybersecurity risks associated with outsourcing business functions to third parties. A company can have robust data privacy and security policies and practices, but if its vendors, who have access to the company's data, do not have a similarly robust cybersecurity program, the company is leaving itself vulnerable.
What regulatory and statutory schemes apply to data our company handles? Companies need to be aware of whether they are subject to federal, state and international laws that require them to take measures to secure sensitive data.
Does our company have, or need, cyber liability insurance? Companies need to consider whether cyber liability insurance is available and appropriate to purchase.
Does our company have sufficient threat detection capabilities? Companies need to ensure that they have state-of-the-art technology for preventing the downloading of malicious software and detecting and alerting the company to attempted breaches.
Does our company have a comprehensive, written breach response plan? It is critical that companies be prepared to respond to a breach quickly, efficiently and calmly. To that end, companies should have a comprehensive, written breach response plan in place, and they must be clear on what will trigger the response plan. As part of this plan, companies should form a breach response team composed of individuals from key departments and external advisors, if necessary, and identify individual functions and responsibilities in case of a breach.
Does our company secure non-digital information and physical devices? Sensitive non-digital information must be safeguarded as well. To the extent possible, companies should minimize the locations in which sensitive non-digital information is stored and should ensure the safe and secure storage of this data.

Related:

Nick Goldin and Karen Hsu Kelley are partners at Simpson Thacher & Bartlett. Associate Jonathan Kaplan contributed to the preparation of this article. The views expressed here are the authors' own.

Special Reports /

Cyber preparedness in the boardroom

Related Stories

Recommended For You