Have you ever considered what would happen if your outsourced IT company or your IT department couldn’t keep up with the growth of your organization and your cyber security needs? It could potentially put you at risk. Wouldn’t it be helpful to be informed about this kind of risk?
Consider this article as your wake-up call.
In recent years, the risks associated with cyber security attacks have grown. They are no longer a low-probability risk, resulting in minor inconvenience.
Organizations of various sizes and types are falling victim to hacking, resulting in significant financial loss, reputation damage, and goodwill loss. For some, experiencing it can lead to the end of their business or career, while for many others, it results in a significant financial setback that can take years to recover from.
ABC NEWS: Americans lost $10.3 billion to internet scams in 2022, FBI says
Should the IT Department Make Strategic Business Decisions?
It is disconcerting to note that a significant number of elected officials and business leaders continue to delegate the responsibility of determining risk tolerance and compliance policies to their IT departments. This approach is not only imprudent but also jeopardizes the overall safety and security of the organization.
It is crucial that decision-makers are well-informed and equipped to make sound judgments based on the potential risks and regulatory requirements. Relying solely on the IT department for such critical decisions can lead to costly errors and a lack of accountability. Therefore, it is imperative that leaders take ownership of these decisions and work collaboratively with their IT team to ensure that the organization’s policies and practices align with its goals and values.
What should you do with an employee who consistently disregards your organization’s data security and password policies and fails to complete cyber security awareness training? Their behavior puts your organization at risk for a cyber-attack and compliance violation. Should your IT manager or IT company reprimand or terminate this employee?
THE RECORD: DHS: Ransomware attackers headed for second most profitable year
It’s important to consider whether it’s their responsibility to manage employee behavior with company data and devices. If you believe it is, have you recently met with them to discuss how to monitor and address this issue? It’s possible that you haven’t had this conversation or only had it a long time ago.
The problem lies in the fact that although most CEOs would agree that the IT department should not make the decision, many of them still entrust the entire responsibility to the IT department or an outsourced IT company. This includes decisions on what is allowed, what isn’t, and how much risk they are willing to take.
Who is to blame if a cyber event happens and the insurance claim is rejected?
Even worse, senior leadership is not even aware that they need to establish policies to safeguard their company against risks and breaches. It is not the sole responsibility of the IT personnel to decide what should or should not be permitted. As the senior management, it is your responsibility to make such decisions.
Cyber Security Insurance
Many companies have invested in cyber liability, ransomware, or crime insurance policies to provide financial relief in case of a cyber-attack. These policies cover the high legal, IT, and other expenses that result from such an event.
However, our experience suggests that most insurance agents and brokers do not understand the IT requirements necessary to secure a policy. Consequently, they fail to advise their clients to ensure that their IT provider or internal IT has implemented the right protocols. If clients do not comply with policy requirements, they risk having their coverage denied.
What will they say about you after the worst happens?
Who is to blame if a cyber event happens and the insurance claim is rejected? Is it the fault of the insurance agent who didn’t provide adequate warning? Or is it the IT department or company who didn’t implement protocols they were never informed about? Ultimately, the responsibility falls on you as the senior management. It’s crucial to ensure that decisions affecting your organization’s risk are well-informed and not made by default.
A great IT company or experienced IT department head will bring these issues to your attention and offer guidance, but most are just keeping the “lights” on and the systems up, NOT consulting their clients on enterprise risk and legal compliance. To ensure that your organization is fully prepared and safeguarded against the consequences of a cyber-attack, you can book a free, private consultation with our advisors to discuss your concerns. This service is free and could provide valuable insights for you. Click here to schedule a consultation, or contact us at (502) 320-3102.