Photo: LevLev/Shutterstock.com

An increasing number of companies are placing their cybersecurity budgets in the hands of their legal departments because of increased compliance efforts and scrutiny from regulators.

According to BTI Consulting Group's Cybersecurity & Data Privacy 2020 report, 46% of companies put the legal department in charge of the cybersecurity budget. The report states that 20% of respondents said the budget is held by information technology, 19.9% in privacy and data security, 7% in compliance, and 6.9% responded the budget is in another department.

The numbers in the report are based on interviews with more than 250 corporate legal decision-makers, including chief compliance officers, chief privacy officers and chief privacy counsel.

Michael Rynowecer, president of BTI Consulting Group in Wellesley Hills, Massachusetts, said the trend of legal departments housing the cybersecurity budget has moved upward over the past couple of years. He said he would expect the number of companies that put legal in charge of the cybersecurity budget will increase.

"Assigning the budget to the department with responsibility for compliance gives them the power and authority to act," Rynowecer said.

The European Union's General Data Protection Regulation and the California Consumer Privacy Act have forced companies to put a greater focus on data privacy and compliance. The changing data privacy and cybersecurity climate make legal "a good crossroad for the budget to sit," Mark Yacano, global practice leader with Major, Lindsey & Africa's transform advisory services in Washington, D.C, said in an interview.

Yacano explained that because legal departments are more often interacting with different elements of the business, those attorneys can "proactively shield the company from risk" by handling cybersecurity budgets and deciding the best ways to prevent a data breach in conjunction with the information technology function.

Allowing only the legal department to totally control the cybersecurity budget "reinforces siloing," Edward McAndrew, a partner at DLA Piper in Washington, D.C., said.

"Siloing is problematic in this area," McAndrew said. "If you think about a cyber incident, you're going to need a multidisciplinary team including legal, information technology, communications, compliance to come together to work on the issue."

He explained that there may be complications tied back to who controls what part of the budget when searching for vendors.

"Legal could be saying we want to bring in a particular service provider, and IT could be thinking something else," McAndrew said.

For companies to have one department control the cybersecurity budget, they need to make certain there is an effective communication line between departments.

"The disadvantage is that legal may not be in a position to make all of the decisions within the scope of the budget," Yacano said. "I think if the governance mechanism for how you approach cybersecurity is not sound there could be issues."

"The best strategy is to work with IT to ensure everyone understands the risks and exposures," Rynowecer said.