10 Critical Steps to Create a Culture of Cybersecurity

10 Critical Steps to Create a Culture of Cybersecurity

by Edward J. McAndrew

The passage is excerpted from a July 26, 2017, article on the website Dark Reading, written by Edward J. McAndrew, Partner & Co-Chair, Privacy & Data Security Group, Ballard Spahr LLP, Faculty Member of the Compliance, Governance & Oversight Council (CGOC).

Businesses are more vulnerable than they need to be. Here’s what you can do about it.

Despite constant headlines about cyber attacks, organizations continue to leave their systems and data unnecessarily vulnerable. Cyber incidents result in the loss of reputation, enterprise value, and jobs, not to mention regulatory fines and civil litigation. According to Kaspersky Labs and the Ponemon Institute, 90% of businesses have experienced a cyber attack, with an average cost per breach of $3.6 million. Ponemon estimates that 27.7% of organizations surveyed will likely suffer another material breach within the next two years.

Although eliminating all cyber incidents is impossible, a “unified governance” approach that combines security with data management and information governance (IG) can help create a business culture that promotes a strong defense. Here are 10 steps you can follow to create a culture of cybersecurity.

1. Bring everyone to the table.
Senior executive engagement is essential. Include your information technology, information security, legal, knowledge management, compliance, privacy, finance, communications, and human resources teams. A lack of participation equals a lack of investment and cooperation required to sustain the effort.

2. Avoid contributing to your own victimization.
Invest in the required technology, training, and business processes to avoid greater long-term costs related to incident response, remediation, fines, lawsuits, and losses to reputation, business, and enterprise value. Be transparent after a breach, and report it to law enforcement. Fear of the consequences causes inaction and exacerbates the harm associated with cyber incidents.

Read more about the 10 steps you can follow to create a culture of cybersecurity.

CGOC focuses on the importance of information lifecycle governance to mitigate risk, reduce cost and increase the value of information. Join our community today to learn more.