In today’s world, organizations must embrace digital transformation if they want to survive. However, rushing into a digital transformation effort without first creating a defensible cybersecurity program will likely result in the organization’s failure. 60 percent of small and medium-sized businesses are out of business within 6 months of a data breach, and for those that survive, the economic impact of a breach can last for years. At Mitchell Martin, we know that a defensible cybersecurity program is key to keeping your organization from transforming itself out of business. That is why we recently welcomed Jim Goepel, CEO and General Counsel of Fathom Cyber LLC and Professor of Cybersecurity Law and Strategy at Drexel University, as the keynote speaker at our inaugural breakfast and learn session. We had a great turn-out and a lively discussion about how to create a defensible cybersecurity program, including legal and regulatory updates and tips for creating a leadership-driven, defensible cybersecurity program.

Starting the Conversation – Harsh Realities for CISOs

The conversation started with a frank assessment of the realities many CISOs face: they simply aren’t on the job long enough to implement their security vision for the organization. The average CISO’s tenure is 18-24 months, and most of the attendees agreed that CISOs spend at least the first 6 months putting out fires, learning about the environment, and making critical configuration changes to help improve the existing environment. Much of the next 6 months largely a waiting game, with the CISO trying to make the best of the current situation while planning, and getting budget approval for, new staff and new tools. As a result, in many cases, implementation of the CISO’s vision doesn’t even really begin until they have been on the job for at least 9-12 months, and that implementation process can easily take another 9-12 months.

Discussing Cybersecurity Hiring Pains

Several attendees mentioned that, if they get budget approval, their attempts to hire qualified candidates can be frustrating. Two significant factors were identified: the highly competitive cybersecurity and data privacy job markets, and the dynamic nature of the field. These factors make it hard for HR departments to write accurate job descriptions or to identify good candidates unless they get help from trusted outside advisors with their fingers on the pulse of the market, like Mitchell Martin. There are similar frustrations on the tool procurement side, with the purchase and implementation phases significantly hampering many CISOs’ ability to quickly respond to the organization’s needs. We discussed how an outside expert like Fathom Cyber can help CISOs create a defensible cybersecurity program that allows the organization’s executives to take ownership of the organization’s cybersecurity, including allowing for more effective communication of risks to the board and C-suite and more efficient executive-level decision making.

The Impact of Laws and Regulatory Changes on Cybersecurity Programs

Jim also provided an update on the ever-changing regulatory and legal environment. One of the big take-aways for many attendees was how recent legislation and regulations like GDPR, CCPA, PIPEDA, 23 NYCRR 500, and even recent efforts by proxy firms to oust executives because they failed to protect the organization from cybersecurity and data privacy issues, have expanded the data breach spotlight to include not only the traditional IT and security teams but also an organization’s executives. By the end of the session, most attendees agreed that their organizations’ leadership will need to transition from merely being informed to being actively involved in creating and governing the organization’s cybersecurity if they want to have a truly defensible program. Jim also pointed out that for most organizations, a defensible cybersecurity program will require significant cultural changes, and that those changes will also have to be driven by their organization’s executives. Some attendees raised concerns about their executives’ willingness to be more hands-on in cybersecurity, and Jim provided several suggestions for making this easier for both the technology teams and the executives.

If you missed out on this informative session, we have good news! We will be offering it again to CISOs and other cyber professionals soon at several additional locations. Enter your details below to request an invite to our next event!