“There's no question that American companies today are under surveillance,” warned an Oct. 24, 2012 New York Times op-ed. In a digital age, information represents power, profit and prestige, yet it's increasingly vulnerable to theft. Competitors from across the street or across the ocean cheat to get ahead, terrorists menace, activists hack to compel change and rapidly changing technologies facilitate all of it.

Importantly, the threat to corporate information involves not only profits but also national security, and Washington is worried. Both houses of Congress perennially propose legislation to improve cybersecurity in the private sector. However, attempts at legislation have failed, most recently in 2012. Now, the Obama administration is taking action.

Executive order

On Feb. 12, President Obama issued an executive order entitled “Improving Critical Infrastructure Cybersecurity,” accompanied by a Presidential Policy Directive (PPD-21). The order does a number of things. First, it defines critical infrastructure as “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, [and] national public health or safety[.]” PPD-21 specifically calls out 16 industries and sectors, including health care, financial services, food and agriculture, and information technology.

Second, the order calls for a partnership with owners and operators of critical infrastructure by instructing the Departments of Justice and Homeland Security and the Director of National Intelligence to provide “unclassified reports of cyber threats to the U.S. homeland that identify a specific targeted entity.” It also expands a voluntary information-sharing program known as Enhanced Cybersecurity Services to include all critical infrastructure. The program provides classified cyber threat and technical information to participants.

Third, the order calls on the National Institute of Standards and Technology (NIST) to create a framework to reduce cyber risk to critical infrastructure. Such frameworks are not new, and many outstanding frameworks currently exist to help practitioners evaluate and select controls to mitigate cybersecurity risk. The federal government is required to adopt these frameworks, particularly those that NIST produces, in securing the government's technical infrastructure. Examples of popular frameworks include the COSO ERM framework for managing enterprise risk, the COBIT framework for managing IT risk, and two frameworks for guiding the design and implementation of information security controls: the ISO 27002 and NIST's own 800-53.. (Some question why NIST is being called upon to deliver yet another framework when existing NIST standards already deal with many aspects of cybersecurity.)

More to come

The executive order is only the beginning of government edicts intended to combat the theft of corporate information. PPD-21 instructs the Department of Homeland Security to “conduct comprehensive assessments of the vulnerabilities of the Nation's critical infrastructure in coordination with the [sector-specific regulatory agencies] . . . and critical infrastructure owners and operators.” The point of risk assessments, of course, is to address vulnerabilities, which will undoubtedly lead to further regulation. Indeed, the order calls upon agencies that oversee critical infrastructure industries to determine whether existing regulations are sufficient to prevent perceived or projected risks. Also, despite the failure of multiple cybersecurity bills, Congress has already proposed new measures. The Rogers-Ruppersburger Cybersecurity Bill, for instance, was introduced recently in the House.

Role of counsel in addressing critical infrastructure cybersecurity risk

Legal counsel play a critical role in creating strategies to defend corporate assets, tracking government responses, and gauging the regulatory and financial impacts of regulations. Among many others, here are four practical tips for getting started:

1. Ensure effective information sharing. Every company needs a mechanism for sharing information about cybersecurity among legal, IT, privacy and compliance functions, with appropriate executive oversight. This is particularly true for companies in targeted industries that face the greatest threats and may receive classified or non-classified briefings. How will you monitor for breaches? Who will receive reports of cyber threats? What will you do legally or technologically to protect against threats? Regular coordination will focus and sync a company's strategic efforts.
2. Plan for breaches. Given the level of threat, it's a question of “when” not “if” your company's information security will be breached. Proactively set protocols for how to handle breaches depending on the seriousness of the breach, the sensitivity of the information exposed (e.g., trade secrets or personally identifiable information of customers), the regulatory requirements and the public relations implications.
3. Consider the business impacts. Cyber threats can infect every level of your business. Strategically assess the risks you face. Consider the impact on supply chains, vendors and equipment, and take action to mitigate risks. For example, reports of foreign-produced hardware and equipment laced with malicious computer code surfaced years ago, and continue to this day. Vendors (including cloud providers) can also introduce vulnerabilities. Strengthen contract requirements, conduct audits and avoid sole-source dependencies. Voluntary public-private programs exist to help mitigate some of these risks. The Information Assurance Directorate of the National Security Agency, for instance, offers certification programs for vendors and hardware who supply the U.S. government.
4. Engage in the debate. Counsel may also play a role in sector- and company-specific involvement in the legislative and regulatory process through comment periods. This activity may prove critical, and counsel may take a unique role in collecting and representing to officials the practical and unintended impacts of various proposals.

“There's no question that American companies today are under surveillance,” warned an Oct. 24, 2012 New York Times op-ed. In a digital age, information represents power, profit and prestige, yet it's increasingly vulnerable to theft. Competitors from across the street or across the ocean cheat to get ahead, terrorists menace, activists hack to compel change and rapidly changing technologies facilitate all of it.

Importantly, the threat to corporate information involves not only profits but also national security, and Washington is worried. Both houses of Congress perennially propose legislation to improve cybersecurity in the private sector. However, attempts at legislation have failed, most recently in 2012. Now, the Obama administration is taking action.

Executive order

On Feb. 12, President Obama issued an executive order entitled “Improving Critical Infrastructure Cybersecurity,” accompanied by a Presidential Policy Directive (PPD-21). The order does a number of things. First, it defines critical infrastructure as “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, [and] national public health or safety[.]” PPD-21 specifically calls out 16 industries and sectors, including health care, financial services, food and agriculture, and information technology.

Second, the order calls for a partnership with owners and operators of critical infrastructure by instructing the Departments of Justice and Homeland Security and the Director of National Intelligence to provide “unclassified reports of cyber threats to the U.S. homeland that identify a specific targeted entity.” It also expands a voluntary information-sharing program known as Enhanced Cybersecurity Services to include all critical infrastructure. The program provides classified cyber threat and technical information to participants.

Third, the order calls on the National Institute of Standards and Technology (NIST) to create a framework to reduce cyber risk to critical infrastructure. Such frameworks are not new, and many outstanding frameworks currently exist to help practitioners evaluate and select controls to mitigate cybersecurity risk. The federal government is required to adopt these frameworks, particularly those that NIST produces, in securing the government's technical infrastructure. Examples of popular frameworks include the COSO ERM framework for managing enterprise risk, the COBIT framework for managing IT risk, and two frameworks for guiding the design and implementation of information security controls: the ISO 27002 and NIST's own 800-53.. (Some question why NIST is being called upon to deliver yet another framework when existing NIST standards already deal with many aspects of cybersecurity.)

More to come

The executive order is only the beginning of government edicts intended to combat the theft of corporate information. PPD-21 instructs the Department of Homeland Security to “conduct comprehensive assessments of the vulnerabilities of the Nation's critical infrastructure in coordination with the [sector-specific regulatory agencies] . . . and critical infrastructure owners and operators.” The point of risk assessments, of course, is to address vulnerabilities, which will undoubtedly lead to further regulation. Indeed, the order calls upon agencies that oversee critical infrastructure industries to determine whether existing regulations are sufficient to prevent perceived or projected risks. Also, despite the failure of multiple cybersecurity bills, Congress has already proposed new measures. The Rogers-Ruppersburger Cybersecurity Bill, for instance, was introduced recently in the House.

Role of counsel in addressing critical infrastructure cybersecurity risk

Legal counsel play a critical role in creating strategies to defend corporate assets, tracking government responses, and gauging the regulatory and financial impacts of regulations. Among many others, here are four practical tips for getting started:

1. Ensure effective information sharing. Every company needs a mechanism for sharing information about cybersecurity among legal, IT, privacy and compliance functions, with appropriate executive oversight. This is particularly true for companies in targeted industries that face the greatest threats and may receive classified or non-classified briefings. How will you monitor for breaches? Who will receive reports of cyber threats? What will you do legally or technologically to protect against threats? Regular coordination will focus and sync a company's strategic efforts.
2. Plan for breaches. Given the level of threat, it's a question of “when” not “if” your company's information security will be breached. Proactively set protocols for how to handle breaches depending on the seriousness of the breach, the sensitivity of the information exposed (e.g., trade secrets or personally identifiable information of customers), the regulatory requirements and the public relations implications.
3. Consider the business impacts. Cyber threats can infect every level of your business. Strategically assess the risks you face. Consider the impact on supply chains, vendors and equipment, and take action to mitigate risks. For example, reports of foreign-produced hardware and equipment laced with malicious computer code surfaced years ago, and continue to this day. Vendors (including cloud providers) can also introduce vulnerabilities. Strengthen contract requirements, conduct audits and avoid sole-source dependencies. Voluntary public-private programs exist to help mitigate some of these risks. The Information Assurance Directorate of the National Security Agency, for instance, offers certification programs for vendors and hardware who supply the U.S. government.
4. Engage in the debate. Counsel may also play a role in sector- and company-specific involvement in the legislative and regulatory process through comment periods. This activity may prove critical, and counsel may take a unique role in collecting and representing to officials the practical and unintended impacts of various proposals.