Last year President Obama issued an Executive Order to help address growing concerns about security breaches relating to confidential information and key computer systems, and the risks that such breaches pose for critical US infrastructure, including infrastructure controlled by a wide range of companies. In October 2013, as directed by the Executive Order, the US Department of Commerce, through its National Institute of Standards and Technology (NIST), issued for comment a set of voluntary standards and best practices intended to help reduce these cybersecurity risks. On February 12, 2014, the final Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework) was released.

The risk of cybersecurity breaches (and the harm that these breaches pose) is one of increasing significance for most companies and therefore an area for heightened board focus. Boards need to understand and be advised on a variety of issues in this complex area, including:

Breach of a company’s data and information systems, whether through inadvertent human error or concerted attack, poses significant risk to corporate operations as well as to critical national infrastructure. In the past year alone, companies have seen a significant increase in events that compromised sensitive corporate data and confidential customer information. These events ranged from concerted external attacks to lapses in corporate security procedures or employee inattention to those procedures. The increased use of mobile devices, social media and cloud computing has increased cybersecurity risks. Further, new developments in communication technologies and their uses tend to outpace the security measures designed to protect information and assets.

As just one example, the growth of the “internet of things,” or smart consumer products with internet connectivity such as automobiles, televisions and even refrigerators, is a development that raises cybersecurity risks in ways that were not anticipated. For example, it has been reported that between late December 2013 and early January 2014, smart appliances (including televisions and at least one refrigerator) were compromised and used to launch a large-scale cyber attack involving malicious e-mails.

Data breaches affect a wide range of industries. According to the 2013 Verizon Data Breach Investigations Report (Data Breach Report) there is usually a relationship between the industry involved and the motive for the attack. The Data Breach Report found that 75% of reported breaches were driven by a financial motive, such as obtaining bank account or credit account access. Obtaining intellectual property or conducting other espionage is also a significant motive, as is general disruption of the company’s or other entity’s operations.

The Data Breach Report, which tracked instances of data breaches in 2012, found that:

Notably, the majority of confirmed data breaches were perpetrated by outsiders.

Common types of cyber attacks include:

Cybersecurity breaches have the potential for significant financial and reputational damage. It is estimated that the average total cost to a US company of a data breach is approximately $5.4 million. In addition to the direct damage caused by a cybersecurity breach, collateral damage may result from:

The Federal Trade Commission has brought over 40 regulatory actions to date against companies for failures to prevent unauthorized access to consumers’ personal information as “unfair or deceptive acts.” Settlements may involve consent decrees requiring improved information security programs and annual independent audits for as long as 20 years.

Further, various state unfair and deceptive trade practices laws may support private rights of action. Companies also need to be concerned with state and federal data breach notification laws and the risk of lawsuits for alleged failure to timely notify affected persons of security breaches that involve exposure of personally identifiable information. Cybersecurity failures could also give rise to negligence and breach of contract claims, depending on the facts of the situation.

In managing and directing corporate affairs, boards have a general obligation to protect corporate assets, including confidential and proprietary information, reputation and goodwill. This includes overseeing the systems that management has put in place to identify, mitigate and manage risks to the company’s business operations. While recent surveys of directors indicate that cybersecurity is a top concern for boards that many directors feel ill-prepared to address, the board’s role with respect to cybersecurity primarily relates to risk oversight.

The technical nature of cybersecurity issues may cause a heightened level of anxiety among directors about whether the board has an appropriate understanding and is providing sufficient oversight. Detailed technological understanding is not required by the board, but the board should be well advised and have access to technological expertise in the management team.

As in other areas, directors are entitled to rely on management and outside experts on these issues. Ultimately, the business judgment rule should apply to the decisions that directors make regarding oversight of cybersecurity issues, so long as they abide by the core standards of care, loyalty and good faith which apply to board decisions generally.

Directors should apply the same common sense approach to cybersecurity risks that they apply to other business risks. A common sense risk oversight approach should not focus unduly on technical issues. It should address issues related to policies and processes, including efforts to educate employees and assure compliance, together with attention to the appropriate deployment of corporate resources.

In general:

While the general principles of risk oversight should govern the board’s efforts relating to cybersecurity issues, boards may find it helpful to consider the guidance provided by the recently released Cybersecurity Framework when engaging management in a conversation about the company’s risk management and preparedness for cybersecurity events.

The Cybersecurity Framework was released by NIST in response to President Obama’s Executive Order 13636, titled Improving Critical Infrastructure Cybersecurity, which required NIST to develop a new voluntary framework of standards and best practices aimed at reducing cyber risks to the nation’s “critical infrastructure.” Critical infrastructure includes physical or virtual systems and assets so vital to the US that their incapacity or destruction would have a debilitating impact on security, national economic security, national public health or safety, or any combination of these areas. Generally this includes telecommunications, energy, finance and transportation companies.

The Cybersecurity Framework is intended to be used by companies to create, assess and improve a cybersecurity program and provides a common framework for discussing, communicating about and evaluating cybersecurity functions. The Cybersecurity Framework sets out five core functions (Framework Core) and related categories of activities for companies to implement that largely relate to risk management and oversight. The Framework Core includes the following:

The Cybersecurity Framework also includes tools that can be used to assess an entity’s cybersecurity compliance by categorizing practices into one of four tiers, ranging from partial compliance to adaptive compliance, and to help a company identify steps to achieve their target cybersecurity profile.

While adoption of the Cybersecurity Framework is voluntary, it will likely become a key reference for regulators, insurance companies and the plaintiffs’ bar in assessing whether a company took steps reasonably designed to reduce and manage cybersecurity risks.

Boards and their advisors should refer to the general principles of risk oversight and the Cybersecurity Framework in engaging management in discussions about cybersecurity issues. They should also consider recent research about the practices of leading companies.

PricewaterhouseCoopers LLP along with CIO and CSO magazines recently conducted an online study of their readers and clients, titled The Global State of Information Security Survey 2014 (Survey). According to the Survey, companies that detected more security incidents and reported lower average financial losses per incident, shared the following key attributes:

Risk oversight principles, the Cybersecurity Framework and emerging best practices suggest that to better position themselves for active oversight of cybersecurity risks, boards and their advisors should:

It is particularly critical that management have clearly defined responsibilities relating to the management of cybersecurity risks, and that members of the senior management team are positioned to function in a well-planned and integrated fashion, including in terms of interaction with regulators, customers, vendors, service providers and the media, in the immediate aftermath of a breach.