Attorney Brent Buckley on Information Governance: What Every "D&O" Needs to Know

A core duty of directors and officers (Ds&Os) is to protect corporate assets, and those of company business partners. This includes protecting confidential information, reputation and goodwill. And it requires oversight of management to develop systems that identify, mitigate and manage risks.

While Ds&Os are not required to have a detailed understanding of technology, they should have a direct understanding of the company's cyber security protocols for preventing and responding to a data breach. Ds&Os should allocate sufficient time on board and corporate meeting agendas to review cyber security, and evaluate what steps have been, or need to be, taken to manage cyber risks. It is then that Ds&Os should determine if specific cyber security insurance is needed and whether it is adequate to cover possible expenses to the company if a data breach occurs.

Cyber security insurance typically covers expenses for:

(i) business interruption, including lost revenues from network disruption;

(ii) "event" management, including notifications, legal, public relations and electronic data loss;

(iii) cyber extortion/ransom, including investigation and reimbursement of expenses to assure continuity of operations; and,

(iv) network security and privacy, including the defense of claims, and payment of settlement and damages.

In addition to insurance protection, the documentation and audits that insurers require provide an opportunity to implement prevention measures, along with loss-detection and reporting systems.

It has been estimated that nearly 90% of "corporate assets" are now maintained on an electronic platform and therefore are susceptible to a tech/cyber crisis. While it is not easy to prove the legal duties Ds&Os have for protecting electronically stored information, some claims are starting to succeed. And, aside from litigation concerns, even a court victory will not remedy reputation, operational or enterprise damage.

This article was published in Crain's Cleveland Business

About Brent Buckley

Connect with Brent Buckley on Facebook

Visit Buckley King's Website