Cyber-Risk Management – Guidance For Corporate Directors

Cyber-risk management is an increasingly important challenge for corporate directors. Many commentators have said that there are only two types of organizations – those that have been hacked and know it, and those that have been hacked and don't know it yet. Corporate directors have a legal responsibility to ensure that their corporations have appropriate cyber-risk management policies and practices and are prepared to effectively respond to cyber-attacks. Corporate directors can obtain helpful guidance from regulators, industry associations and other organizations.

CYBER-RISKS

Cyber-risks are risks of damage, loss or liability (e.g.financial loss, business disruption loss, loss to stakeholder value, reputational harm and legal noncompliance liability) to a corporation resulting from a failure or breach of the corporation's information technology systems. Cyber-risks can result from both internal sources (e.g. employees, contractors, service providers and