Advisen has released report titled, “A New Era in Information Security and Cyber Liability Risk Management: A Survey on Enterprise-wide Cyber Risk Management Practices,” which summarizes the results of a survey of over 500 risk management professionals. More than 60 percent of the survey participants work for companies with annual revenues exceeding $1 Billion a year while the remainder work for smaller companies.

The survey results suggest that businesses are recognizing the seriousness of the risks posed by potential compromise of data security. The vast majority of respondents stated that their organization views information security as at least a moderate threat and more than two-thirds of respondents stated that information security risks are a specific risk management focus within their organizations. Most organizations have some form of multi-departmental information security and cyber risk team or committee, and more than two thirds of respondents said their organizations have a disaster response plan in place in the event of a major breach.

Despite widespread recognition of data breach risk, risk contingency planning may still be inadequate. For 41 percent of respondents, the IT department is responsible for complying with state data breach notification laws following a breach. The IT department often may be ill-equipped to satisfy the inconsistent notification requirements of the 46 different states that have enacted breach notification laws and the independent obligations that may arise under federal laws, such as HIPAA-HiTech and Gramm-Leach-Bliley, or under industry self-regulation, such as the CPI rules. The recent adoption of breach notification rules in various jurisdictions around the globe further complicates data breach response. Furthermore, the majority of the organizations represented by this survey have not acquired cyber insurance as a tool for managing the risks associated with data breach. This statistic may change as companies consider the SEC’s recent recommendation that companies disclose in their SEC filings both: 1) the particular data security risks that their organization faces; and 2) the insurance they have in place to address that risk.

Photo of Gerald J. Ferguson Gerald J. Ferguson

Gerald Ferguson currently serves as the Intellectual Property, Technology and Media Group Coordinator for the firm’s New York office. Mr. Ferguson also serves as the national leader of the firm’s Privacy and Information Security group. He has worked with companies to create national…

Gerald Ferguson currently serves as the Intellectual Property, Technology and Media Group Coordinator for the firm’s New York office. Mr. Ferguson also serves as the national leader of the firm’s Privacy and Information Security group. He has worked with companies to create national and global privacy policies. He has extensive experience advising companies regarding compliance with state breach notification laws. Mr. Ferguson is able to advise clients regarding notification obligations quickly and efficiently using a state-by-state survey of the 47 jurisdictions with breach notification laws that is regularly updated by Baker Hostetler’s Privacy and Information Security group. As part of his proactive approach to an incident response, he works with forensic consultants to develop the substantive opinions necessary to support a determination that disclosure of a breach is not required when possible. If disclosure is required, he uses a team approach to carefully manage the process in a cost-effective and efficient manner that focuses on minimizing reputational harm.

Mr. Ferguson is Chairman of the Intellectual Property Committee of the New York State Bar Association, International Law and Practice Section.

Read more about Gerald J. FergusonEmailGerald's Linkedin ProfileGerald's Twitter Profile
Show more Show less