How serious do companies take Cyber Security? It depends on who you ask...General Counsels and IT Security seem to disagree.

How serious do we take Cyber Security? I guess it depends on who you ask. General Counsels and  IT Security seem to disagree.

BDO’s fourth annual Inside E-Discovery & Beyond survey which examines the opinions and insights of more than 100 senior in-house counsel about changes in their approaches to e-discovery, information governance, compliance, and cybersecurity. 

Most officers responsible for cybersecurity will admit that no system is impenetrable and attacks will get through. Thus most corporate counsel will need to take actions to disprove cyber negligence. Considering that, Seventy-three percent of the respondents report that their board is more involved in cybersecurity than 12 months before. Over 60% of respondents report boards being briefed at least quarterly. (Source BDO Inside e-Discovery & Beyond - March 2018)

HOWEVER this seems to contradict a similar study. IT professionals were asked a similar question in Data Protection Risks & Regulations in the Global Economy. More than 550 IT security and compliance professionals involved with their companies' global privacy and data security were asked how prepared they feel their companies are to respond to a data breach.

In this study, only 30 percent of survey respondents said their respective C-suite executives are fully aware of the state of their companies' cyber strategy. Moreover, only 38 percent of respondents agreed senior leadership views compliance, privacy, and data protection as a top priority.

Now, admittedly, the questions were not exactly the same but you can bet that if the C-suite doesn’t care, the board probably doesn’t either. On the other hand, General Counsel would likely be in a better position to know what the board is briefed on and lawyers wouldn't exaggerate, would they?