The fact that legislators and regulators widely consider cybersecurity to be a risk management issue rather than a compliance exercise is a good news, bad news story.
On the upside, in the absence of clear legal or contractual obligations, cybersecurity generally dismisses checklist requirements (which may have little to no applied value) in favor of informed judgments. There are choices. The downside of enjoying this flexibility, however, is the second-guessing that invariably begins should something go wrong: what could have been done to prevent the incident, and was it reasonable not to have done so?
Yet, what exactly is reasonable? The answer is known to the State of California to include the Top 20 Critical Security Controls published by the Center for Internet Security. According to the Golden State, “the failure to implement all the Controls that apply to an organization’s environment constitutes a lack of reasonable security.” California also expressly calls for companies to encrypt personal data and to make multi-factor authentication available to consumers.
At the national level, the Federal Trade Commission looks to various factors to determine reasonableness, “including the size and complexity of a company’s operations, the amount and sensitivity of data it collects, and the availability of low-cost tools to mitigate threats.” The FTC also supports the NIST Cybersecurity Framework, believing it can be “a model for companies of all sizes to conduct risk assessments and mitigation.”
Significantly, the FTC has acknowledged, “Just because a company experiences a breach does not mean its data security practices were unreasonable.” Still, it remains difficult to know what security failings the FTC considers reasonable since the FTC does not bring enforcement actions in those situations. We do know that for an organization’s security to be considered unfair and deceptive, it must cause or be likely to cause substantial injury “not reasonably avoidable by consumers and not outweighed by the benefits to consumers or competition.” Note that FTC cost-benefit analysis in this context focuses on consumer outcomes rather than the company’s self-interest in saving money.
With these considerations in mind, a good rule of thumb to ensure reasonable cybersecurity is to take AIM: Align, Implement and Measure.
Align. Whether it’s the NIST Frame-work, the CIS Top 20, ISO, or any other standard, it is advisable to pick one. There may not be correct answers for cybersecurity, but aligning against industry standards helps organizations ensure they considered the right questions.
Implement. Having policies and assessing risk are necessary steps, but they are not sufficient. Organizations must then implement appropriate physical, administrative and technical controls to mitigate the highest ranked business and victim-centric risks, and should consider creating risk registers to accept, track and manage remaining material risks.
Measure. In addition to conducting periodic penetration tests and vulnerability assessments, organizations should monitor for emerging threats and perform routine program audits. If the cybersecurity program isn’t measured, does it reasonably exist?
As a closing thought, consider this sobering, yet motivational phrase for achieving reasonable cybersecurity: ready, AIM, and you won’t get fired.
