Legal Departments Should Leverage Their Information Security Organization

How legal works with information security is discussed at nearly every cybersecurity conference that I attend. I suppose that I have begun to take it for granted that legal departments and information security organizations understand the importance of forming an alliance to jointly protect their company. 

Unfortunately, I recently learned of a situation where no alliance exists. The company’s Information Security Officer recommended a particular attorney who practices in the area of cybersecurity to discuss assisting the company with its technology procurement and vendor management activities. The attorney mentioned that it may be appropriate to engage the Information Security Officer into the conversation to discuss what is specifically needed to accomplish the ultimate goal of mitigating potentially devastating data breaches and the volume and complexity of the agreements. The response from the legal department was that the Information Security Officer would NOT be