This is the third and final installment in our series on cybersecurity … a concern that affects all of us, whether we own a business or not. As Monique and Nick have shared, the cybersecurity risks and responsibilities change as a company grows, sometimes bringing serious financial and legal consequences.

 

For a small business, the conversation may center on strong passwords, multifactor authentication and reliable backups. Those things still matter as an organization expands. But once a company reaches 25, 50 or 100 employees, cybersecurity becomes something bigger.

It becomes a leadership issue.

 

“A cyber incident is a legal problem, a financial problem, an operational problem, and it can be a reputational problem too,” explains Dr. Monique Rogers, cofounder of ARRC Technology. “Sometimes all of those in the very same afternoon.”

 

Together with ARRC Technology Vice President Nick Points, Monique helps businesses understand that cybersecurity is no longer simply an IT concern.

 

Monique brings nearly 30 years of technology experience to the conversation, along with a master’s degree in law with a concentration in cybersecurity. Technology asks how businesses can prevent an attack. Her legal studies added another critical question: What happens if prevention fails and what will the company need to demonstrate afterward?

 

That is why she believes every CEO should be able to answer five questions before an attack happens.

 

Could a CEO identify all the sensitive information the company possesses?

Start with a basic inventory:

 

“You can’t protect information you don’t know you have,” Monique says.  Nick puts it just as plainly: “Ignorance is not a defense.”

 

Sensitive information might include Social Security numbers, birthdates, addresses, phone numbers, employee records, financial information or confidential customer information.

 

Nick says information can also be exposed outside a company's walls through third-party vendors, cloud services, subscriptions and other online platforms. If credentials connected to a corporate domain are compromised elsewhere, the company may not immediately know.

 

ARRC monitors the dark web for its clients and alerts them when credentials associated with their corporate domains appear in an exposure. “We get alerts every week,” Nick says.

 

Companies should also consider whether they are retaining information they no longer need. Monique has encountered businesses holding archived data unnecessarily, creating additional exposure.

 

Privacy laws, contracts, breach-notification requirements and industry regulations can create different responsibilities. There is no single rule that suddenly applies when a business hires employee No. 25. That is one reason legal counsel should be part of the conversation.

 

Imagine ransomware is discovered at 2 a.m.

 

A company's incident response plan should identify who may need to be contacted:

 

“You’ve got to have the phone numbers before you need the phone numbers,” Monique says.

 

Companies also need to know who determines whether customers or regulators must be notified and who preserves evidence. Most importantly, the response plan needs to remain accessible when technology fails.

 

“Your incident response plan should work when your computers don’t,” Monique says.

If the only copy is stored on a server that ransomware just encrypted, it isn't particularly useful.

 

Nick points out that businesses also need to understand their cyber liability insurance before filing a claim. Applications can ask whether particular cybersecurity protections are in place, and answers should accurately reflect what an organization is actually doing.

 

Finding out there is a gap after an attack is far too late.

 

Forget cybersecurity terminology for a moment.

 

If the company's technology stopped working at 10 a.m., what would happen at 10:15? Could the company:

 

Then ask: What happens on day two? Day five? Day 10? At that point, cybersecurity becomes a business continuity issue affecting revenue, efficiency and reputation.  

 

Backups matter, but simply having them isn't enough.  “There’s an enormous difference between having a backup and knowing you can actually recover,” Monique says.

 

A CEO should know:

 

Nick makes a similar point about security systems. Having antivirus software, a firewall or other protections doesn't necessarily mean a company is adequately protected. “It doesn’t mean anything if you don’t test them,” he says.

 

Cybersecurity isn't only about prevention. It is also about creating an organization capable of surviving an attack.

 

Artificial intelligence has created extraordinary opportunities for businesses. Monique uses it herself and believes companies should take advantage of its capabilities. But they need rules.

 

An employee trying to work faster can easily paste a contract, financial report, employee file, customer list, confidential email or proprietary process into an AI system. The intentions may be good, but what happens to that information afterward?

 

“AI isn't the problem,” Monique says. “It's unmanaged AI.”

 

Employees need simple rules:

 

Companies also need to consider AI-enabled threats, including increasingly convincing phishing messages, deepfakes and voice impersonation.

 

The goal isn't to prohibit AI. It's to use it deliberately.

 

Saying a company takes cybersecurity seriously is one thing. Proving it is another.

 

After an incident, an insurance carrier, attorney, regulator, client or even a judge may want evidence that the company took reasonable precautions.

 

Leadership should be able to show that the company:

 

The NIST Cybersecurity Framework offers a straightforward way to think about the process: govern, identify, protect, detect, respond and recover.

 

Nick emphasizes that no single cybersecurity product can do all of that. “Security is layers,” he says.

 

Multifactor authentication, antivirus protection, employee education, dark web monitoring, access controls and backups can all provide different layers of protection. “You have to have multiple layers in place,” Nick says.

 

That becomes increasingly important as companies grow. More employees, vendors and systems can mean more potential points of exposure.

 

Nick compares stolen credentials to having a key to a building: “It is much easier to walk through the door with the key than to break the door down,” he explains.

 

Businesses also shouldn't assume that outsourcing a service eliminates their responsibility to protect information. A third-party breach can still leave a company dealing with customers, business interruption, insurance questions and financial consequences.

 

That makes preparation more than an IT responsibility. It is a business responsibility.

 

For Monique and Nick, the goal isn't to frighten CEOs. It's to help businesses become more resilient. Technology should help businesses grow. AI should help employees become more capable. Cybersecurity should protect what business owners and their teams have spent years building.

 

And preparation needs to happen before the crisis.  “Don't wait until after a cyberattack to discover what you wish you'd done before it,” Monique says.

 

Because once the attack happens, the questions don't disappear. They simply become much more expensive to answer.