Cybersecurity Lessons From The United States: A Guide For Directors And Officers

The recent global ransomware attack (WannaCry) was yet another reminder of the increased threat posed by cyber breaches. While cybersecurity attacks are inevitable, organizations (and their directors and officers) may still be liable to the extent they failed to take reasonable steps to prevent the attack, or failed to respond appropriately to the attack.

Understanding what is expected of an organization is therefore critical to minimizing exposure from cyberattacks. There is little case law in Canada that provides direction. But there is useful direction from the Federal Trade Commission (FTC) of the United States which has been seeking to enforce such matters for approximately 15 years. Generally, the FTC complaints described below resulted in a fine being paid by the target organization and/or an agreement by the organization to take specified steps to address its cybersecurity posture.