{"id":503,"date":"2021-12-27T13:41:00","date_gmt":"2021-12-27T13:41:00","guid":{"rendered":"https:\/\/legaleasesolutions.com\/?post_type=news-post&p=503"},"modified":"2023-07-27T13:16:17","modified_gmt":"2023-07-27T13:16:17","slug":"how-legal-departments-can-help-define-a-companys-cybersecurity-benchmarks","status":"publish","type":"news-post","link":"https:\/\/legaleasesolutions.com\/news-post\/how-legal-departments-can-help-define-a-companys-cybersecurity-benchmarks\/","title":{"rendered":"How Legal Departments Can Help Define A Company\u2019s Cybersecurity Benchmarks"},"content":{"rendered":"\n

This article by Tariq Akbar<\/strong>, LegalEase Solutions, was published on December 27, 2021<\/strong> on Forbes.com<\/a><\/strong><\/em><\/p>\n\n\n\n

In today\u2019s electronically driven business environment, everybody is under the threat of a cyberattack. As technology has advanced, cybersecurity evolved from a nice-to-have functionality to an essential tool in corporations\u2019 technical arsenals.<\/p>\n\n\n\n

It is not hard to see why: Verizon\u2019s 2021 Data Breach Investigations Report (registration required) revealed that global companies confronted 79,635 suspected cyber incident cases in 2020 alone. Of these cases, 5,258 were confirmed data breach incidents. Even law firms are not immune to these pressures, as 29% of law firms experienced at least one data security breach in 2020, according to a report by the American Bar Association. This figure is up from 26% in 2019.<\/p>\n\n\n\n

Legal in the Cloud Requires Stringent Cybersecurity Measures <\/strong><\/h2>\n\n\n\n

As the pandemic has influenced more businesses to move their operations into the cloud, organizations will need to take the necessary steps to build up their safeguards and incident response strategies. However, companies wading through the alphabet soup that describes today\u2019s privacy regulatory environment will find no uniform guidance on the specific standards companies should be following to protect consumer data. This lack of direction is problematic for companies, especially those that must balance multiple privacy regulations.<\/p>\n\n\n\n

Consider the General Data Protection Regulation and California Consumer Privacy Act, for example. Experts have touted both as helpful barometers for companies since they represent the most stringent privacy standards on both sides of the Atlantic. However, even these supposedly similar laws have their distinct differences, including different definitions and enforceability triggers. For example, the CCPA requires businesses to honor do-not-sell requests for consumer data, while its European counterpart \u201cdoes not include a specific right to opt-out of personal data sales,\u201d according to Practical Law. Alternatively, the GDPR requires companies to obtain parental consent for all processing consent requests for minors\u2019 data, while the CCPA mandates parental consent for personal sales of minors\u2019 data.<\/p>\n\n\n\n

How LegalEase Solutions Helps Organizations Stay Compliant With Regulatory and Compliance Measures<\/strong> <\/strong><\/h2>\n\n\n\n

My company helps law firms and corporations navigate the regulatory and compliance environment. Through this, I\u2019ve seen that as global companies and firms balance their privacy responsibilities, many are encountering challenges in managing their liabilities in transactions and consumer data initiatives. These uncertainties have crept into service level agreement negotiations with supply chain and business partners. Today, it is not unusual for companies to sign unlimited cybersecurity liability clauses in their SLAs with business partners. It is a peculiar strategy that I\u2019ve found is surprisingly common with tech-centered SLAs.<\/p>\n\n\n\n

It is true that not all data is the same, and not all data includes the types of personally identifiable information that most data privacy laws cover. Still, I\u2019ve observed vendors and companies often agree to assume broad liability for data and security incidents, primarily to avoid piecemeal negotiations on data security standards as their services expand. Many also agree to these clauses over uncertainties regarding the types of data they would conceivably handle for the duration of their business relationships.<\/p>\n\n\n\n

Types of Cybersecurity Measures to Ensure Full Data Protection <\/strong><\/h2>\n\n\n\n

In light of these clauses and tactics, what cybersecurity measures and safeguards are sufficient to ensure full protection? To answer this, we can simplify a business\u2019s data privacy concerns into two camps. The first area is the client-side considerations that consumer data privacy laws address, while the other entails security measures for business operations. These latter measures address safeguards for securing proprietary business data, including trade secrets and confidential materials, away from the public. While there are nuances to both areas, each requires a different security approach.<\/p>\n\n\n\n

Companies ultimately will need to factor in one set of standards that protects the servers hosting users\u2019 data and another set that addresses the safety and integrity of their IT systems and business information. Therefore, companies will need to weigh different minimum requirements, reliable confidence levels and baseline capabilities when protecting data from internal and external liabilities. <\/p>\n\n\n\n

Questions Legal Departments Should Ask the IT Department <\/strong><\/h2>\n\n\n\n

Fortunately, the legal function can work in tandem with a company\u2019s compliance and IT departments to benchmark their organization\u2019s safeguards and cybersecurity capabilities. The questions they will ultimately need to address can be boiled down to the following:<\/p>\n\n\n\n