Cyber risk escalates

In saying this, we understand why managing cyber risk often falls to the CIO or CISO. In our experience, many incidents could have been prevented with basic IT hygiene, such as keeping software updated by promptly rolling out patches, deploying enterprise-wide multi-factor authentication systems, restricting and regularly reviewing privileges and putting your remote desktop protocol behind the organisation's firewall.

Like our survey respondents, we also believe cyber security is, at its core, an IT risk. But cyber risk is also no different to any other risk. Boards, executives and legal leaders need to understand cyber risk so they can fully participate in discussions about it and to meaningfully respond to threats.

One of the most acute challenges to the effectiveness of organisations' responses to cyber risk is language: technical teams and boards are still struggling to understand each other. “There is a language disconnect,” says Herbert Smith Freehills Partner and APAC Cyber Security Head Cameron Whittfield. “CISOs give briefings, and boards ask questions, but it is not clear to us whether ultimately there is shared understanding, and often we play the role of translator.”

Simulations give participants a risk-free opportunity to clarify roles and responsibilities and to practice delegations and decision-making. They also shine a light on weaknesses in an organisation’s cyber resilience program. This leads to a renewed focus and investment in systems and processes, in advance of a real-life crisis.

And yet too many organisations are still only turning their attention to cyber preparedness when an attack occurs.

This is particularly the case with boards. This year’s survey shows that 70% of boards have been educated about cyber risk, but only 40% have participated in a simulation exercise. Participation in simulations was notably higher for executive teams, at 69%.

The appropriate delineation of roles and responsibilities between the board and the executive team in a cyber crisis can be markedly different from everyday operations – particularly for ‘active’ boards.

“It can come as a surprise to directors that they play a relatively limited role in responding to a cyber crisis. While they must proactively supervise the response, very few decisions bubble up to board level. Boards must have confidence in management’s ability to respond, and the interplay between management and the board is critical,” Whittfield says. Ironing out creases in a simulated environment facilitates a smoother response in a real crisis.

Indeed, in our practice, we observe that sophisticated boards often bring a welcome sense of calm and strategic clarity to cyber incident response.

An essential role for legal teams

Lawyers are downplaying their relevance and deprioritising their preparedness. Our survey indicates that over 80% of respondents do not have a legal team budget dedicated to cyber risk. Furthermore, half of legal teams have never participated in a cyber simulation.

“These investment decisions echo the intense resourcing pressures imposed on in-house legal teams in the current environment. However, they do not sit comfortably alongside the integral role played by legal advisers in a cyber crisis,” says Senior Associate, Heather Kelly, who brings expertise in both corporate law and at the frontline of cyber incident management, as an in-house lawyer. This observation is not lost on many survey respondents: 75% of respondents regard the legal team as “central” to their organisation’s crisis response in the event of a cyber incident.

Lawyers may be intimately involved in reviewing compromised data, engaging with regulators; drafting communications for staff, customers and suppliers; assessing compliance risk and operational impacts; responding to contractual claims; and engaging with insurers. “Missteps managing the legal side of each incident response workstream can have significant regulatory and commercial consequences,” says Kelly.

Obtaining adviser pre-clearance from insurers, in advance of an incident, puts an organisation in a strong position to be supported before, during and after an event, by a team that understands their people, processes and business strategy. The fly-in-fly-out cyber triage approach is certainly losing favour with large corporates.