{"id":4124,"date":"2018-07-20T08:28:07","date_gmt":"2018-07-20T07:28:07","guid":{"rendered":"https:\/\/citysecuritymagazine.com\/?p=4124"},"modified":"2019-05-07T13:30:08","modified_gmt":"2019-05-07T12:30:08","slug":"information-security-gdpr-boardroom","status":"publish","type":"post","link":"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/","title":{"rendered":"Cyber Security: data protection reaches the boardroom"},"content":{"rendered":"

Cyber Security – Data Protection reaches the boardroom<\/strong><\/h1>\n

It was a wake-up call when the Information Commissioner warned a room full of senior executives at the beginning of the year that data protection was, “not just an issue for the IT guy down the corridor\u2026 if you want all the benefits of digital you must manage the risk. It is the responsibility of the Chief Executive”.<\/p>\n

Since then Christopher Graham has been vocal in highlighting that there is no excuse for organisations not taking action on data protection and maintaining an effective Cyber Security capability. Referring to the cyber attack on TalkTalk last October as a “car crash”, he stated that, “Any other company with half a brain should be checking their systems now to make sure they don’t land up in the same situation.”<\/p>\n

When a watchdog uses this language in front of MPs, as Christopher Graham did during his evidence to the Culture Media and Sport Select Committee, you know a line has been crossed. It is understandable when you accept that it was a preventable attack, and since the October \u201ccar crash\u201d TalkTalk has experienced a further breach in the security of its customer records after three people were arrested in connection with making scam calls from an Indian call centre used by the telecoms group.<\/p>\n

GDPR<\/h6>\n

And if the above isn\u2019t a \u201cwake up and smell the coffee\u201d moment, then the European General Data Protection Regulation (GDPR), which has just been ratified by the European Council, should certainly make General Counsels, lawyers and senior Directors start to twitch. This new EU Regulation (not simply a Directive) places specific obligations on all large companies and introduces an eye-watering maximum penalty for non-compliance set at \u20ac20m or 4% of global turnover, together with the potential of criminal prosecution of executives for the most serious of data breaches.<\/p>\n

It was the risk of multi-billion dollar regulatory fines for money laundering that put the subject of \u201ccompliance\u201d on Boardroom tables and we can see that Data Protection may soon be following. And in all fairness it\u2019s not before time; technology has offered huge growth potential through the manner in which information can be accessed and stored but the thirst for new business hasn\u2019t always been followed by sensible precautions for data security or protection.<\/p>\n

That is all likely to change when the new GDPR is phased in over the next year-and-a -half (no matter what happens in the UK\u2019s referendum on EU membership, GDPR will affect UK businesses). Amongst other changes, the new provisions require all personal data stored to have a defined life cycle. Businesses will have to document their Data Protection risk and consider this in all new technology, products and services.<\/p>\n

What should companies be doing?<\/h6>\n

So what should companies \u201cwith half a brain\u201d be doing about this? Everything, unsurprisingly, starts with the Board but too few are wrestling with this challenge in an effective manner, that in itself could become a personal risk for Board members. A recent published article by security law expert Thomas Bennett reviews personal liability in the event of a breach and concludes that for the Directors of listed businesses it is a \u201cmaterial possibility\u201d. The pragmatic response is for Board Members to look to their senior staff to provide reassurance that the Threat is being managed. Unfortunately, all too often, those staff are getting it wrong and that is often due to an over-reliance on technology as a solution.<\/p>\n

In some ways the term \u201cCyber\u201d hasn\u2019t helped and it naturally leads some into detailed and often complex conversations about patches, firewalls and IT networks. Of course the technical protection must be in place but the new Data Protection requirements will also place obligations on organisations to think more broadly about their information assets, particularly when you consider that over half of all major data breaches involve people and processes, not technology.<\/p>\n

Effective solutions require cultural change and that means a plan including re-training staff and re-configuring important policies and procedures. Some organisations won\u2019t need to do much but others will need to invest substantially. The place to start is with an independent information security health check. It is second nature to have auditors look at our books and Boards can get reassurance that they have discharged their fiduciary responsibilities by doing so. Well, the same applies with Cyber Security; the health check, or a more formal audit, assessment does need to be independent and authoritative and Boards should resist an over-reliance on their own people telling them everything is fine.<\/p>\n

Leadership and creating an effective governance accountability framework is next, to ensure that those who control the business operationally also own the information risk. All of this is achievable and good Boards are introducing \u201cInformation Assurance\u201d as a standing agenda item, with effective performance information balancing costs against business risk.<\/p>\n

Get in order<\/h6>\n

The new EU General Data Protection Regulation will be formally implemented next year; there is still time to get your house in order. Ambitious companies will grab this risk and turn it into an opportunity. Smart businesses with big brains are already recognising market differentiation and the enablement of the business they can achieve by investing in good Information Assurance and Cyber Security.<\/p>\n

Adrian Leppard QPM, Board Director, Templar Executives<\/p>\n

www.templarexecs.com<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Cyber Security – Data Protection reaches the boardroom It was a wake-up call when…<\/p>\n","protected":false},"author":19,"featured_media":4089,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"footnotes":""},"categories":[36,85,4182],"tags":[],"class_list":["post-4124","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security","category-gdpr-data-privacy","category-templar-executives"],"acf":[],"yoast_head":"\nCyber Security: data protection reaches the boardroom - City Security Magazine<\/title>\n<meta name=\"description\" content=\"Companies are reminded that GDPR and data protection is "not just an issue for the IT guy. It is the responsibility of the Chief Executive."\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cyber Security: data protection reaches the boardroom\" \/>\n<meta property=\"og:description\" content=\"Cyber Security - Data Protection reaches the boardroom It was a wake-up call when the Information Commissioner warned a room full of senior executives at\" \/>\n<meta property=\"og:url\" content=\"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/\" \/>\n<meta property=\"og:site_name\" content=\"City Security Magazine\" \/>\n<meta property=\"article:published_time\" content=\"2018-07-20T07:28:07+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2019-05-07T12:30:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/60p11.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1170\" \/>\n\t<meta property=\"og:image:height\" content=\"780\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Contributor CSM\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@CitySecuritymag\" \/>\n<meta name=\"twitter:site\" content=\"@CitySecuritymag\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Contributor CSM\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/\"},\"author\":{\"name\":\"Contributor CSM\",\"@id\":\"https:\/\/citysecuritymagazine.com\/#\/schema\/person\/1b424dabf8b3cf40177efb7350e059f2\"},\"headline\":\"Cyber Security: data protection reaches the boardroom\",\"datePublished\":\"2018-07-20T07:28:07+00:00\",\"dateModified\":\"2019-05-07T12:30:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/\"},\"wordCount\":897,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/60p11.jpg\",\"articleSection\":[\"Cyber Security\",\"GDPR & Data privacy\",\"Templar Executives\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/\",\"url\":\"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/\",\"name\":\"Cyber Security: data protection reaches the boardroom - City Security Magazine\",\"isPartOf\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/60p11.jpg\",\"datePublished\":\"2018-07-20T07:28:07+00:00\",\"dateModified\":\"2019-05-07T12:30:08+00:00\",\"description\":\"Companies are reminded that GDPR and data protection is \\\"not just an issue for the IT guy. It is the responsibility of the Chief Executive.\\\"\",\"breadcrumb\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/#primaryimage\",\"url\":\"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/60p11.jpg\",\"contentUrl\":\"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/60p11.jpg\",\"width\":1170,\"height\":780,\"caption\":\"GDPR boardroom\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/citysecuritymagazine.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cyber Security: data protection reaches the boardroom\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/citysecuritymagazine.com\/#website\",\"url\":\"https:\/\/citysecuritymagazine.com\/\",\"name\":\"City Security Magazine\",\"description\":\"News and advice for security professionals\",\"publisher\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/citysecuritymagazine.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/citysecuritymagazine.com\/#organization\",\"name\":\"City Security Magazine\",\"url\":\"https:\/\/citysecuritymagazine.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/citysecuritymagazine.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/06\/header-logo-2.jpg\",\"contentUrl\":\"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/06\/header-logo-2.jpg\",\"width\":2048,\"height\":573,\"caption\":\"City Security Magazine\"},\"image\":{\"@id\":\"https:\/\/citysecuritymagazine.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/CitySecuritymag\",\"https:\/\/www.linkedin.com\/company\/city-security-magazine\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/citysecuritymagazine.com\/#\/schema\/person\/1b424dabf8b3cf40177efb7350e059f2\",\"name\":\"Contributor CSM\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/citysecuritymagazine.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/267a3b16d581feb77df68e95969d9bcf7cfe93d4e2f5f699b331bf4de6a055b9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/267a3b16d581feb77df68e95969d9bcf7cfe93d4e2f5f699b331bf4de6a055b9?s=96&d=mm&r=g\",\"caption\":\"Contributor CSM\"},\"description\":\"City Security magazine is proud to work with contributors from across the security sector and beyond, including police forces, security associations, security providers, consultants and specialists who produce a range of varied and interesting content.\",\"url\":\"https:\/\/citysecuritymagazine.com\/author\/contributor-csm\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Cyber Security: data protection reaches the boardroom - City Security Magazine","description":"Companies are reminded that GDPR and data protection is \"not just an issue for the IT guy. It is the responsibility of the Chief Executive.\"","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/","og_locale":"en_GB","og_type":"article","og_title":"Cyber Security: data protection reaches the boardroom","og_description":"Cyber Security - Data Protection reaches the boardroom It was a wake-up call when the Information Commissioner warned a room full of senior executives at","og_url":"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/","og_site_name":"City Security Magazine","article_published_time":"2018-07-20T07:28:07+00:00","article_modified_time":"2019-05-07T12:30:08+00:00","og_image":[{"width":1170,"height":780,"url":"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/60p11.jpg","type":"image\/jpeg"}],"author":"Contributor CSM","twitter_card":"summary_large_image","twitter_creator":"@CitySecuritymag","twitter_site":"@CitySecuritymag","twitter_misc":{"Written by":"Contributor CSM","Estimated reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/#article","isPartOf":{"@id":"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/"},"author":{"name":"Contributor CSM","@id":"https:\/\/citysecuritymagazine.com\/#\/schema\/person\/1b424dabf8b3cf40177efb7350e059f2"},"headline":"Cyber Security: data protection reaches the boardroom","datePublished":"2018-07-20T07:28:07+00:00","dateModified":"2019-05-07T12:30:08+00:00","mainEntityOfPage":{"@id":"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/"},"wordCount":897,"commentCount":0,"publisher":{"@id":"https:\/\/citysecuritymagazine.com\/#organization"},"image":{"@id":"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/#primaryimage"},"thumbnailUrl":"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/60p11.jpg","articleSection":["Cyber Security","GDPR & Data privacy","Templar Executives"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/","url":"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/","name":"Cyber Security: data protection reaches the boardroom - City Security Magazine","isPartOf":{"@id":"https:\/\/citysecuritymagazine.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/#primaryimage"},"image":{"@id":"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/#primaryimage"},"thumbnailUrl":"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/60p11.jpg","datePublished":"2018-07-20T07:28:07+00:00","dateModified":"2019-05-07T12:30:08+00:00","description":"Companies are reminded that GDPR and data protection is \"not just an issue for the IT guy. It is the responsibility of the Chief Executive.\"","breadcrumb":{"@id":"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/#primaryimage","url":"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/60p11.jpg","contentUrl":"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/07\/60p11.jpg","width":1170,"height":780,"caption":"GDPR boardroom"},{"@type":"BreadcrumbList","@id":"https:\/\/citysecuritymagazine.com\/cyber-security\/information-security-gdpr-boardroom\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/citysecuritymagazine.com\/"},{"@type":"ListItem","position":2,"name":"Cyber Security: data protection reaches the boardroom"}]},{"@type":"WebSite","@id":"https:\/\/citysecuritymagazine.com\/#website","url":"https:\/\/citysecuritymagazine.com\/","name":"City Security Magazine","description":"News and advice for security professionals","publisher":{"@id":"https:\/\/citysecuritymagazine.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/citysecuritymagazine.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/citysecuritymagazine.com\/#organization","name":"City Security Magazine","url":"https:\/\/citysecuritymagazine.com\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/citysecuritymagazine.com\/#\/schema\/logo\/image\/","url":"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/06\/header-logo-2.jpg","contentUrl":"https:\/\/citysecuritymagazine.com\/wp-content\/uploads\/2018\/06\/header-logo-2.jpg","width":2048,"height":573,"caption":"City Security Magazine"},"image":{"@id":"https:\/\/citysecuritymagazine.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/CitySecuritymag","https:\/\/www.linkedin.com\/company\/city-security-magazine"]},{"@type":"Person","@id":"https:\/\/citysecuritymagazine.com\/#\/schema\/person\/1b424dabf8b3cf40177efb7350e059f2","name":"Contributor CSM","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/citysecuritymagazine.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/267a3b16d581feb77df68e95969d9bcf7cfe93d4e2f5f699b331bf4de6a055b9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/267a3b16d581feb77df68e95969d9bcf7cfe93d4e2f5f699b331bf4de6a055b9?s=96&d=mm&r=g","caption":"Contributor CSM"},"description":"City Security magazine is proud to work with contributors from across the security sector and beyond, including police forces, security associations, security providers, consultants and specialists who produce a range of varied and interesting content.","url":"https:\/\/citysecuritymagazine.com\/author\/contributor-csm\/"}]}},"_links":{"self":[{"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/posts\/4124","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/comments?post=4124"}],"version-history":[{"count":1,"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/posts\/4124\/revisions"}],"predecessor-version":[{"id":7471,"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/posts\/4124\/revisions\/7471"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/media\/4089"}],"wp:attachment":[{"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/media?parent=4124"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/categories?post=4124"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/citysecuritymagazine.com\/wp-json\/wp\/v2\/tags?post=4124"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}