Is Your D&O Team Ready to Deal with Cyber Crime?

Despite this,  company directors and officers are facing greater regulatory and legal oversight to manage and disclose cyber security issues. They must ensure they have appropriate cyber security measures in place to protect their company’s digital assets.

As well, the Federal Court recently set a precedent for financial services firms to have adequate risk management systems to thwart and manage cyber risks. That also extends to other businesses, who are authorised representatives of the licensee. The court ordered the defendant, RI Advice Group Pty Ltd, to pay $750,000 of the Australian Securities & Investments Commission’s (ASIC) legal costs. Read more about the judgment and ASIC’s report on it here.

Therefore, failing to step up to D&O responsibilities opens up risks should a data breach occur including:

• Legal and regulatory
• Shareholder derivative action, or
• A shareholder suit against D&Os for breaching their fiduciary duty.

What’s the government doing about it?

The Federal Government released its Ransomware Action Plan last October, which introduces a criminal offence for cyber extortion – here’s a link to federal laws that cyber criminals face. However, under the plan, the government will mandate that companies with a $10M-plus turnover report ransomware incidents, and has indicated it will boost this regulation, according to law firm Corrs Chambers Westgarth. Paying a ransom may be a criminal offence, and even though there are defences, there’s a lot of uncertainty.

As well, the government has set up a new Australian Federal Police-led multi-agency task force ‘Operation Orcus’ operation to target ransomware attacks linked to organised crime groups operating here and overseas. The Federal Department of Home Affairs has also set up the Cyber and Infrastructure Security Centre to actively deal with regulatory moves and partnerships to protect our nation’s critical infrastructure. You can find a comprehensive register of those asset classes here, plus obligations for responsible entity holders or direct interest holders.

The government’s Cyber Security Industry Advisory Committee has issued Locked Out: Tackling Australia’s ransomware threat, which advises businesses to:

• Practice good cyber security hygiene, including following the Australian Cyber Security Centre’s essential eight
• Have multi-factor authentication for email security
• Keep software up to date
• Continuously train employees about the risks and how to manage them
• Regularly back up your data
• Archive data more than 15 months old to reduce the amount of data that could be impacted.

That presumes a high level of cyber expertise and risk management at board and officers’ fingertips.

What are your D&O responsibilities?

For D&Os, managing cyber risks is a core governance issue that comes under a duty of care and diligence, Section 180(1) of the Corporations Act, according to professional services consultancy PwC. However, there haven’t been any significant Australian cases or regulatory prosecutions of D&Os concerning ransomware attacks or preparedness … yet.

Boards should be actively engaged in managing cyber risks, and can look to ASIC for cyber guidance. They cover 11 good practices, including:

1. Board engagement
2. Responsive governance
3. Cyber risk management and threat assessment, including reporting notifiable data breaches
4. Third-party risk management
5. Collaboration and information sharing
6. Asset management
7. Cyber awareness and training
8. Protective measures and controls
9. Detection systems and processes
10. Response planning (critical infrastructure and data protection system), and
11. Recovery planning.

It’s worth pointing out that businesses should have appropriate contracts and processes in place to make sure their suppliers, service providers and sub-contractors also meet cyber security requirements.

Don’t overlook cyber insurance