Cyber Guardians

85 Chapter 3 Legal and Regulatory Landscape 87 Overview of Relevant Cybersecurity Regulations and Laws 90 Federal Regulations in the United States 90 The Federal Trade Commission Act 90 The Gramm-Leach-Bliley Act 92 The Health Insurance Portability and Accountability Act 94 State Regulations in the United States 97 Data Breach Notification Laws 97 California Consumer Privacy Act 99 European Union Regulations 101 General Data Protection Regulation 101 Network and Information Security Directive 102 ePrivacy Directive 104 Industry Standards 105 Payment Card Industry Data Security Standard 105 National Institute of Standards and Technology 107 Securities Exchange Commission 108 2011 Cybersecurity Disclosure Guidance 108 2018 Cybersecurity Disclosure Guidance 108 2023 Proposal for New Cybersecurity Requirements 109 Discussion of Compliance Requirements and Industry Standards 112 Compliance Requirements 112 Sarbanes-Oxley Act 112 New York State Department of Financial Services Cybersecurity Regulation 114 Industry Standards 117 Center for Internet Security Controls 117 International Organization for Standardization 27001 118 Individual Director Liability 120 Chapter 3 Summary 124 Chapter 4 Board Oversight of Cybersecurity 127 The Board's Role in Overseeing Cybersecurity Strategy 129 Legal Responsibilities 130 Developing an Effective Cybersecurity Governance Framework 131 Best Practices for Board Engagement and Reporting 133 Regular Reporting 133 Use of Metrics 134 Executive Briefings 136 Cybersecurity Drills 137 Independent Assessments 138 Overcoming Objections to Effective Cybersecurity Oversight 139 Promoting a Cybersecurity Culture 141 Chapter 4 Summary 143 Chapter 5 Board Oversight of Cybersecurity: Ensuring Effective Governance 145 The Role of the Board in Overseeing Cybersecurity 147 Developing an Effective Cybersecurity Governance Framework 150 Conduct a Cybersecurity Risk Assessment 150 Implement a Threat Intelligence Program 150 Develop a Risk Management Framework 150 Prioritize High-Impact Risks 151 Regularly Review and Update Risk Management Strategies 151 Strategies for Identifying, Assessing, and Prioritizing Cyber Risks 152 Conducting Cybersecurity Risk Assessments 154 How to Develop and Promote a Culture of Cybersecurity 156 Chapter 5 Summary 158 Chapter 6 Incident Response and Business Continuity Planning 161 Implementing Cybersecurity Policies and Procedures 164 Incident Response and Business Continuity Planning 165 Incident Response Plan 166 Business Continuity Planning 166 Incident Response Planning 167 Defining the Types of Assessments 170 Penetration Testing 170 Vulnerability Scanning 171 Security Risk Assessments 173 Threat Modeling 174 Social Engineering Assessments 175 Compliance Assessments 176 Red Team/Blue Team Exercise 177 Chapter 6 Summary 178 Chapter 7 Vendor Management and Third-Party Risk 181 The Importance of Third-Party Risk Management for Board Members 183 Best Practices for Managing Third-Party Cyber Risk 184 Legal and Regulatory Considerations in Third-Party Risk Management 185 Sample Questions to ask Third-Party Vendors 187 Chapter 7 Summary 189 Chapter 8 Cybersecurity Training and Awareness 191 Importance of Cybersecurity Awareness for All Employees 193 Strategies for Providing Effective Training and Awareness Programs 195 More Detail on Effective Training Strategies 198 Chapter 8 Summary 200 Chapter 9 Cyber Insurance 201 Understanding Cyber Insurance 202 What Is Cyber Insurance? 202 Why Is Cyber Insurance Important? 203 Evolution of Cyber Insurance 204 The Role of the Board in Cyber Insurance 204 Key Components of Cyber Insurance 205 Types of Coverage 205 Policy Limits and Deductibles 206 Exclusions 207 Retroactive Dates 207 Policy Periods 208 Cyber Risk Assessments 208 Evaluating and Purchasing Cyber Insurance 209 Assessing the Organization's Risk Profile 209 Determining the Appropriate Level of Coverage 210 Selecting an Insurer 211 Negotiating Terms and Conditions 211 Implementing the Policy 212 Managing and Reviewing the Cyber Insurance Policy 213 Filing a Claim 213 Managing a Claim Dispute 214 Reviewing and Renewing the Policy 214 Chapter 9 Summary 215 Chapter 10 Conclusion: Moving Forward with Cybersecurity Governance 219 The Board's Role in Cybersecurity Governance 222 Key Takeaways and Action Items for Board Members 225 Chapter 10 Summary 226 Appendix A Checklist of Key Considerations for Board Members 229 Appendix B Sample Questions 231 Appendix C Sample Board Meeting Agenda 233 Appendix D List of Key Vendors 235 Appendix E Cybersecurity Resources 237 Appendix F Cybersecurity Books 239 Appendix G Cybersecurity Podcasts 241 Appendix H Cybersecurity Websites and Blogs 243 Appendix I Tabletop Exercise: Cybersecurity Incident Response 245 Appendix J Articles 249 About the Author 253 Acknowledgments 255 Index 257