In-House Counsel's Growing Role in Data Protection and Security Risk Management

Mapping the Risk

• Policies and standards: A strong framework of policies must be the foundation. Often there are a number of standards in different parts of a company, but they are not coordinated. It is important to take a top down approach, so a common security, privacy and data protection taxonomy and standards are in place holistically across the organization.
• Identification and classification: Not all data is equal across a company, and a map of the data landscape is critical. Critical assets should be identified and grouped together, separate from the less sensitive information stored within the organization.
• Governance: The policies established must include built-in enforcement measures. Processes and technologies can be leveraged to track internal compliance with policies and ensure they are sustained across the organization and with third parties.
• Regulatory considerations: Most multi-national organizations are dealing with a patchwork of regulations, and data protection programs must address compliance with any industry and cross-border requirements that apply.
• Change management: The entire workforce must be on board for programs to be effective. Change management and training are critical elements to any such program and will drive awareness so that everyone from the board members to the interns understand what must be done.

Developing Incident Response

• Assessment: The plan should outline the organizational environment, including identified roles and responsibilities for who will be involved in certain incidents based on the risk model. This also includes defining a broader governance committee of stakeholders across legal, IT, executive leadership, information security, etc.
• Defense: The plan implements and manages defensive best practices, including access control, network maintenance and deployment of proactive technology. Continuous monitoring to identify threats rapidly and proactively (a result of knowing in advance the main areas of risk) helps keep the organization one step ahead of threats.
• Response: Even a huge investment of time, budget and energy into cybersecurity will not make an organization immune. Response must be viewed not as an IT problem, but as a business operations activity. It should ensure proper notification of authorities and impacted parties, as required by the various laws to which the organization is subject.
• Recovery: This is where practice drills and lessons learned come into play. Teams must holistically look at the nuances of the breach to learn from it and strengthen the position so it does not happen again.

Conclusion