AICD's guide for directors on governing through a cyber crisis

Steps to get your board prepared 10 min read

On 28 February 2024, the Australian Institute of Company Directors (AICD) published Governing through a cyber crisis: cyber incident response and recovery for Australian directors (the guide).

The full guide is an essential read for directors, in-house counsel and senior management.

The AICD has already produced a handy snapshot of the guide, so we haven’t summarised it ourselves (we also think it is worth reading it in full, if you can).

Instead, this Insight highlights some of the more interesting and nuanced points, and provides our observations, commentary and suggested next steps.

About the guide 

The guide should be read alongside the Cyber Security Governance Principles (see the snapshot here) published by the AICD and the Cyber Security Cooperative Research Centre in October 2022, which focussed on cyber risk management and resilience (as opposed to cyber incident readiness and response, which is the focus of the new guide).

The guide is a living document that the AICD says will be updated periodically. It is not binding and has no regulatory force, but it is thoughtful, practical and comprehensive and we expect it to set expectations (both in the market and amongst regulators) as to how directors should govern through a cyber crisis.

The guide outlines key points and questions, red flags and further detail in respect of each of the key phases of a cyber crisis—readiness, response, recovery and remediation. It also provides additional information on the board’s role in dealing with cyber extortion.

Observations

1. Cyber readiness

The guide emphasises that boards should be confident their organisations are cyber-ready, not that there are no gaps in cyber readiness. In fact, any suggestion by management that there are no such gaps could itself be a red flag for the board to probe further.

Note: in all of the recent cyber incident class action claims (in relation to the Optus and Medibank incidents) the fact that a major data breach has occurred is said to support an inference that the defendant's data-handling and cyber security systems and controls were inadequate in some way.

However, the occurrence of a data breach incident (whether or not caused by a third-party threat actor) does not in and of itself mean an organisation's privacy or data protections are non-compliant with applicable law, particularly in circumstances where the threat landscape is evolving and increasingly sophisticated.

As the OAIC itself found in its investigation report in September 2011 into the Sony PlayStation Network/Qriocity data breach (which considered the predecessor to APP 11.1, NPP 4.1): 'A targeted attack does not necessarily mean that the organisation has failed to take 'reasonable steps'.'¹ Although this investigation is now dated, we view this position as unchanged.

For further detail on data breach class actions, see: Takeaways from the Optus and Medibank data breach class actions.

2. Evolving threat landscape

The guide emphasises the dynamic nature of cyber readiness and recommends:

• ongoing consideration of emerging risk scenarios (including as part of training and simulations);
• incorporating lessons from real incidents into response plans and training; and
• regular testing and continuous improvement of response plans.

3. Active board involvement and board process

The guide lists areas that may require more active involvement by boards. The guide also comments on board processes during a crisis and the importance of balancing the need for reporting to the board to enable appropriate oversight of the incident response, alongside the understanding that management will be under significant pressure and focussed on responding to the incident. The guide suggests that although board papers should be prepared and presented on key actions being undertaken, emerging and current risks, and progress on critical issues, extensive board papers wont always be necessary and verbal briefings and updates via email may be adequate.

4. Employee welfare and apportionment of accountability

Acknowledging that 'fatigue suffered by those responding to a cyber incident has a measurable impact on performance and recovery', the guide recommends that boards satisfy themselves that management has taken appropriate measures to understand and mitigate psychosocial risks associated with fatigue stress experienced by employees and frontline staff during an incident response, as well as unacceptable behaviours from impacted customers and the public.

5. No scapegoating

The AICD also considers it a red flag for organisations to blame failures on one or two individuals and instead emphasises that accountability be apportioned fairly. This is because organisations as a whole are responsible for cybersecurity and cyber awareness, so the failure of one employee can often indicate a failure of the organisation.

6. Customer remediation and compensation

The guide emphasises the importance of an effective remediation, compensation and complaints-handling process in actively contributing to restoring customer trust, meeting regulator expectations and mitigating future litigation risks. It suggests the board should approve (or delegate the approval of) customer-remediation and compensation plans.

Note: this is also an increasing focus for the Cyber Security Response Coordination Unit (CSRCU). The CSRCU is (amongst other things) assisting Australian corporates to navigate and coordinate engagement with the multitude of agencies required to assist in replacing or putting holds on government-issued identity documents or other identifiers that may have been compromised in a cyber incident. Cyber incident response plans should contemplate this process, as well as other support that may need to be provided to affected individuals, such as counselling, credit monitoring, reimbursement etc.

7. Specific guidance for larger organisations

The guide contains a range of guidance specifically targeted at larger organisations.

8. Communications and reputation management

The guide places significant focus on consistent, timely and transparent communications as a way to mitigate third-party impact and also minimise reputational damage to the business. In particular, the guide notes that major cyber incidents can prompt emotional responses from impacted customers and members of the public, and recommends that any communications are sensitive to this. It also emphasises that any statements made should be stress-tested for accuracy, particularly given the facts are likely to be rapidly evolving in the early stages of an incident.

Note: response plans should include an integrated communications plan with clear principles agreed at the outset to guide messaging, and ideally copies of template communications that can be adapted appropriately.

9. Regular cyber simulations

The guide suggests that good practice is to run simulation testing at least twice a year, using different scenarios, supported with focused desktop training sessions throughout the year. Critical infrastructure entities, or those at higher risk due to the nature of their industry, operations or the data they hold, should look to run simulations on a quarterly basis. For more on cyber simulation programs, read Why every company should have a structured cyber simulation program.

10. Customer remediation and compensation

The guide emphasises the importance of an effective remediation, compensation and complaints-handling process in actively contributing to restoring customers' trust, meeting regulator expectations and mitigating future litigation risks. It suggests the board should approve (or delegate approval of) customer remediation and compensation plans. Specific, targeted recommendations for impacted customers are advised, as is communicating empathetically with affected stakeholders.

Note: the CSRCU is playing an increasingly active role in helping to coordinate the approach across multiple government agencies where government identity documents are compromised. We recommend involving the CSRCU prior to finalising a customer remediation program to ensure the proposed program is in line with evolving agency practice.

11. Legal input

The guide acknowledges that 'timely and comprehensive legal advice will often be critical to a board and organisation effectively responding to a cyber crisis', and expressly identifies a range of areas in which boards require legal input. It also flags the need to ensure early consideration is given to the trigger points for engaging external support (whether legal support or other inputs to inform legal advice, such as forensic services).

12. Data governance

The guide reinforces that a comprehensive data governance framework is one of the fundamental building blocks of an effective cyber risk governance program. For example, clear mapping of data assets will assist the board in a cyber incident to quickly assess the sensitivity of any affected data. The guide's specific reference to data governance reflects a renewed, broader focus on data governance as a critical component of cyber risk management and underscores the importance of keeping existing data governance frameworks regularly updated.

13. Allocation of, and access to, necessary funds

The guide specifically suggests boards should consider whether sufficient resources and funds are available to the business to remediate cyber incidents 'at the appropriate scale and pace'.

14. Prioritisation of contractual requirements, including notifications

In addition to notifications to affected individuals and applicable regulators, the guide calls out the potentially significant contractual implications associated with a cyber incident. Taking into account that there may be a wide range of disparate contractual obligations triggered in the event of a cyber incident, it suggests boards consider whether the business has prioritised the various relevant obligations in order of urgency. It also recommends factoring timeframes for necessary contractual notifications into the overall list of notifications, which should be included in incident response plans.

What should you do next? 

1. Consider the adequacy of your cyber incident response plans and your update schedule – ask whether they:
   • include a methodology for conducting compromised data assessments?
   • contemplate the mental health and wellbeing support that may be required for staff impacted by the incident?
   • include a customer remediation plan?
   • include a detailed communications plan?
   • include triggers to ensure legal and other external experts are being brought in, and expert advice is being sought at the right time?
   • have sufficiently flexible triggers for updates to the plan to allow for continuous improvement, having regard to the evolving threat landscape and lessons learnt from recent incidents?
2. Check back in on your data governance framework. Many of these have faltered over the past few years with the increased focus on cyber controls, despite the two being inextricably linked (after all, cyber incidents often shine a light on deficient data handling practices). In addition to confirming ongoing compliance with the framework, organisations may need to refresh policies and processes.
3. Revisit your cyber simulation and training program. Are simulations being run frequently enough? Are learnings incorporated into your response plans?
4. Maintain a register of contractual requirements (eg notification requirements) that may be triggered in a cyber incident.
5. Confirm whether IT security reviews (including security control testing) are being undertaken by independent cyber experts with a mandate to objectively challenge the design and appropriateness of controls, identify gaps and highlight areas requiring investment and uplift.

For more on board considerations, download our guide: (Almost) Everything you need to know about cyber risks, resilience and responsibilities.

For those interested in the backstory to the guide…

Guidance for directors navigating cyber risks has been on the agenda for some time.

In August 2022, the Cyber Security Industry Advisory Committee issued its second annual report on Australia's 2020 Cyber Security Strategy. In that report, the Committee noted that clarifying the responsibilities and duties of boards and their directors in relation to cybersecurity through voluntary governance standards for cyber best practice was a critical and urgent next step.

Then, early in 2023, the Government released its first discussion paper on its proposed new 2023-2030 Cyber Strategy and commenced a comprehensive consultation process. One of the more controversial issues canvassed during the process was the introduction of legislation that would impose prescriptive requirements on directors in relation to cyber risk management.

This proposal was strongly and successfully (and, in our view, quite rightly) resisted across industry on the basis that directors' duties and other risk management requirements already do the job—they just need to be appropriately applied and enforced. Plus, the last thing corporate Australia needs is another duplicative regulatory regime.

But the consultation on this proposal also helpfully unearthed widespread acknowledgement that organisations were crying out for practical guidance in an area that had been lacking much of it (with the exception of a few short ASIC and APRA guides).

This latest AICD guide is, in many ways, the product of that demand.