What Companies Can Do To Protect Against Cyberattacks … and the Litigation That Often Follows

• Cybersecurity oversight is increasingly critical for board directors due to growing threats and evolving regulatory expectations, such as new SEC disclosure requirements.
• Boards should evaluate and refine governance structures, ensuring clear roles, effective monitoring systems, and proper documentation to mitigate risks and potential litigation following cyber incidents.
• Well-documented oversight and proactive governance frameworks provide legal defenses and strengthen companies’ positions in managing cybersecurity risks.

Cybersecurity threats are expanding due to factors like digitization, cloud computing, and AI, prompting boards of directors to prioritize cybersecurity oversight. Recent SEC regulations mandate public companies to disclose their board’s role in managing cybersecurity risks, including identifying responsible committees. This shift and legal pressures exemplified by recent lawsuits such as those against CrowdStrike have led many boards to reassess and refine their cybersecurity governance structures.

Effective governance requires thoughtful assignment of cybersecurity oversight, often to the audit, technology, or risk committees, depending on the company’s structure and the centrality of cybersecurity to its operations. Boards should ensure these committees have the expertise and bandwidth to manage ongoing challenges. Additionally, Delaware law emphasizes directors’ duty to implement and monitor risk oversight processes, including IT asset mapping, dependency analyses, and transparent chains of command for cybersecurity governance.

Boards must demonstrate good-faith efforts to oversee cybersecurity risks, as courts generally dismiss oversight-related lawsuits when directors can show they maintained monitoring systems and documented their activities. Cases like those involving Marriott and SolarWinds underscore the importance of thorough documentation and proactive governance in defending against legal challenges. To further strengthen oversight, boards should delegate cybersecurity to a specific committee, establish compliance systems, regularly review reports, and document processes to address shareholder demands for transparency and litigation preparedness.

By adopting these strategies, boards can navigate evolving cybersecurity challenges, align with regulatory requirements, and protect their organizations from cyberattacks and associated legal risks.

Read the full article