The New York Department of Financial Services (“DFS”) has found that corporate insurance departments and general counsel infrequently participate in cyber security-related corporate governance issues – and recommends their greater involvement.
In a report on cyber security in the banking sector, the DFS found that corporate governance around cyber security tends to be highly IT-centered. When asked which divisions and employees participated in their organizations' cyber security governance structure, institutions cited IT departments most frequently (92 percent), followed by compliance officer (73 percent), risk management (64 percent), chief executive officer (61 percent), chief information officer (60 percent), and business operations (57 percent).
Notably, the report found, certain divisions and employees appeared to be “underrepresented in institutions' cyber security governance structure.” The report specifically highlighted general counsel (29 percent), public information/communications (25 percent), and corporate insurance (22 percent).
The report concluded:
The inclusion of these divisions could only serve to strengthen cyber security governance within an institution and to ensure a holistic approach to managing cyber risk and addressing the consequences of a cyber breach. The General Counsel should advise on potential legal liabilities arising from a cyber event, as well as any indemnifications of potential litigants following a breach. Corporate Insurance should evaluate the need for (or adequacy of an institution's) cyber risk coverage or, alternatively, determine the extent to which Directors and Officers liability policies might apply in the absence of a cyber-specific policy. Similarly, an institution's Public Information/Communications team should identify potential stakeholders requiring feedback in the aftermath of a cyber attack, as well as anticipate the number and types of inquiries that may arise.