Transference of risk via insurance or to ‘trusted business partners’ in common place for many core businesses functions. Unfortunately, in many scenarios, you cannot transfer the responsibility of the duty of care easily if at all to another organization. Items such as the Payment Card Industry – Data Security Standard (PCI-DSS) is a great example of how precise these arrangements must be and how elusive they can be to initially achieve much less maintain over time. The ecosystem of software, hardware, network and cloud providers for your organizations as well as your supply chain is very difficult to trust with a high degree of confidence without a highly disciplined and well thought out risk oversight program.
Cyber and similar insurance policies reward well run, cyber-savvy organizations with lower premiums. These insurer’s due diligence review of an organization’s security posture and resilience capability is increasingly thorough and becomes more mature every year. Insurers are prepared to pay when appropriate; but will likely be one of many teams on-site after a security incident to verify that stated policies, processes and procedures were properly followed prior to any payment distribution.
Regulators are also starting to weigh in on this concept of transferring risk to other parties. Some regulators are trying to send a clear message that if your organization does NOT handle risks appropriately that it will impact your bottom line. Some regulators have gone so far as to say that the fines and penalties must be paid directly by the organization and CANNOT be paid by a 3 rd party insurer.
Prepare for bad things to happen
Be transparent with key stakeholders on your capabilities
Come clean when you have an incident
Prevent insider trading when a non-public event could negatively impact stock price/shareholder value.