A CEO Blueprint: What to Do if Your Company Is Cyberattacked

Since the Target breach more than a year ago, we at Chief Executive have gone to great lengths to make it clear to CEOs that cybersecurity is now their responsibility. We’ve emphasized that they need to be fully up to speed on their company’s protective capabilities and emergency response plan, to ensure the systems are strong enough to keep hackers out and to ensure that they themselves can adequately answer all questions on the topic from board members, shareholders and the media, both during quiet times as well as after an attack. This article is a thorough blueprint that can help fulfill both those goals by fast-tracking CEOs’ cybersecurity learning process.

If there hasn’t been a criminal investigation, should you ask for one?
If your company is not subject to any of the aforementioned reporting provisions and law enforcement is not otherwise aware of the cyber attack, you need to weigh several competing considerations to determine whether to request a criminal investigation.

For instance, any of the following factors could militate against contacting the appropriate criminal authorities:

Possible liability – Notifying law enforcement may ultimately lead to civil liability or worse for the company, depending on the firm’s role in causing or failing to stop the breach. To make matters worse, facts bearing on the company’s role may not be known to the company until weeks or months after the breach, and it may turn out that the breach was not the result of criminal activity. In other words, the company could notify law enforcement unnecessarily and essentially call the police on itself. This is the most serious concern.

“Notifying law enforcement may ultimately lead to civil liability or worse for the company.”

Disruption of your business – The data breach is likely to disrupt your business; the presence of government agents or investigators on-site examining or imaging your servers and interviewing your employees will only add to that disruption.

Risk of increased publicity – Although law enforcement likely will attempt to conduct their investigation without publicly exposing the intrusion or data breach (at least preliminarily), involving law enforcement may draw attention to the incident (both internally and externally) and could result in negative press. In the event of an arrest and trial of the perpetrator, the company’s reputation could be damaged further if it turns out that lax controls at the company facilitated the crime.

Confidentiality concerns – Your company may be concerned about sharing with law enforcement confidential information, including trade secrets and privileged communications with counsel. An investigation carries with it the possibility of a prosecution, the exchange of discovery, and a trial, none of which is likely to be known in the immediate aftermath of the breach. The government, not the victim corporation, decides whether to bring charges.

Note that, at the outset of an investigation, you may be able to negotiate with the government a confidentiality agreement that specifies to whom the government may show the information. And if the investigation leads to an arrest and a trial, more robust confidentiality agreements and protective orders, often authorized by statute (depending on the nature of the information at issue), might provide greater protections to corporate secrets.


MORE LIKE THIS

  • Get the CEO Briefing

    Sign up today to get weekly access to the latest issues affecting CEOs in every industry
  • upcoming events

    Roundtable

    Strategic Planning Workshop

    1:00 - 5:00 pm

    Over 70% of Executives Surveyed Agree: Many Strategic Planning Efforts Lack Systematic Approach Tips for Enhancing Your Strategic Planning Process

    Executives expressed frustration with their current strategic planning process. Issues include:

    1. Lack of systematic approach (70%)
    2. Laundry lists without prioritization (68%)
    3. Decisions based on personalities rather than facts and information (65%)

     

    Steve Rutan and Denise Harrison have put together an afternoon workshop that will provide the tools you need to address these concerns.  They have worked with hundreds of executives to develop a systematic approach that will enable your team to make better decisions during strategic planning.  Steve and Denise will walk you through exercises for prioritizing your lists and steps that will reset and reinvigorate your process.  This will be a hands-on workshop that will enable you to think about your business as you use the tools that are being presented.  If you are ready for a Strategic Planning tune-up, select this workshop in your registration form.  The additional fee of $695 will be added to your total.

    To sign up, select this option in your registration form. Additional fee of $695 will be added to your total.

    New York, NY: ​​​Chief Executive's Corporate Citizenship Awards 2017

    Women in Leadership Seminar and Peer Discussion

    2:00 - 5:00 pm

    Female leaders face the same issues all leaders do, but they often face additional challenges too. In this peer session, we will facilitate a discussion of best practices and how to overcome common barriers to help women leaders be more effective within and outside their organizations. 

    Limited space available.

    To sign up, select this option in your registration form. Additional fee of $495 will be added to your total.

    Golf Outing

    10:30 - 5:00 pm
    General’s Retreat at Hermitage Golf Course
    Sponsored by UBS

    General’s Retreat, built in 1986 with architect Gary Roger Baird, has been voted the “Best Golf Course in Nashville” and is a “must play” when visiting the Nashville, Tennessee area. With the beautiful setting along the Cumberland River, golfers of all capabilities will thoroughly enjoy the golf, scenery and hospitality.

    The golf outing fee includes transportation to and from the hotel, greens/cart fees, use of practice facilities, and boxed lunch. The bus will leave the hotel at 10:30 am for a noon shotgun start and return to the hotel after the cocktail reception following the completion of the round.

    To sign up, select this option in your registration form. Additional fee of $295 will be added to your total.