Cyber risk threat increasing and a top governance risk

Key findings

Important observations for Boards and CEOs, and C-suite executives:

1. Testing of data breach response plans is increasing – from 34% to 55% in the last 12 months
2. Low adoption of external cyber frameworks – this needs to improve if organisations are to better manage cyber risks
3. Individuals remain the prime targets of bad actors – 70% of cyber incidents arise from phishing attacks
4. 40% of survey respondents considered that cyber security risks have increased due to the shift to remote working

Woe betide anyone who doesn't consider cyber risk to be a top risk for organisations and the boards that lead governance. The risk is growing and regulators are watching."Paul Kallenbach, Partner

Regulatory changes on the horizon

Regulatory changes relating to cyber risk, privacy and data protection are looming, and ASIC and other regulators are increasing their attention and enforcement action.

For example, ASIC has identified 'deterrence-based enforcement action' as one of its critical cyber supervisory projects for 2021. In 2020 ASIC took its first cyber-related enforcement action against RI Advice Group, an Australian financial services licensee for failing to implement adequate policies and systems and ensure sufficient resources were deployed to manage cyber risk across its authorised representative group.

Areas of legal exposure include claims against directors, ASX continuous disclosure rules, personal liability for directors who breach their obligations, misleading and deceptive conduct, contract claims, and (for some organisations) APRA’s prudential standards relating to outsourcing.

According to Kallenbach, "The regulatory layers are confronting. Banks and other financial institutions, and the health and public sectors, for example, are subject to additional regulatory obligations. The Commonwealth is also flagging a significant overhaul of privacy laws to bring them closer to a GDPR standard. There is also pressure from customers, particularly for organisations that have suffered a significant data breach."

If directors are not asking difficult questions on cyber risk, I can’t see how they are discharging their directors’ duties.”

Paul Kallenbach