Increased regulation and litigation coupled with the growing threat of hackers disrupting a company have led boards of directors to become more involved in their companies' cyberincident response plans.

"Compliance and new regulations, whether it's a cross-sector of regulation like GDPR [General Data Protection Regulation] or a sector-specific regulator, these are certainly things that are driving the board to pay closer attention," said Michael Mahoney, a partner at Tapestry Networks and the Cyber Risk Director Network lead.

Because the risks of a cyberthreat include compromised business methods and hefty fines from regulators, boards of directors often want to know how a situation is being handled early on, according to a recently published Tapestry Networks report. For some regulations, boards of directors are required to show regulators that they are compliant with the laws.

Mahoney said general counsel need to help craft a plan that is "deep technically but broad in terms of who needs to be involved."

"There is not always alignment as to what the escalation protocol looks like," he added.

While board members, consumers and regulators often want swift transparency, Mahoney said the general counsel has to take into consideration litigation the company could be facing for a breach.

"That puts the general counsel in a tough spot," he said.

According to the report, board members would prefer to be notified sooner than later and they would rather have some information, even if that information is incomplete. Further many board members want a seat on the response team. This further shows the information technology department is no longer the sole department responsible for cybersecurity and data breaches.

In addition to making sure flagging the right managers to lead cybersecurity incidents, boards of directors should be planning early and often about how they're going to handle issues when they arise, said Jonathan Day, chief executive at Tapestry Networks.

Day said starting that process early in the life cycle of a new initiative or product "necessarily puts together legal and IT."

"It becomes a matter of strategy and not a technical matter," he added.

Edward McAndrew, a partner at DLA Piper in Washington, D.C., said there will be a time where boards of directors will require their general counsel to have a minimum standard of cybersecurity experience.

"General counsel have an overflowing plate, and this is going to be a key issue going forward. We would not ask lawyers to be responsible for the technical aspects of a cybersecurity program," McAndrew said. "Why would we ask the IT department or chief information security officer in all of these burgeoning laws that apply to cybersecurity?"