10 Questions Every General Counsel (GC) Should Ask About Their Organization

In today's complex threat landscape, general counsels (GCs) must be proactive in understanding and managing their organization's cybersecurity posture. The GC can help bridge communication gaps between the IT department and executives, and help the organization manage cybersecurity risk more effectively.

Here are ten critical questions every GC should be asking to ensure their organization is well-protected and resilient against cyber threats:

1. What Percentage of Our Accounts Are Protected by Multi-Factor Authentication (MFA)?

Multi-factor authentication (MFA) is a crucial line of defense against unauthorized access. It's essential to ensure that your IT team provides regular reports on the percentage of accounts covered by MFA and to work towards achieving full coverage. MFA significantly reduces the risk of account breaches, making it a fundamental component of your cybersecurity strategy.

Key Points:

• Regularly review MFA coverage reports.
• Strive for complete MFA implementation.
• Understand the role of MFA in your overall security framework.

2. Are Our Data Backups Isolated, and Have We Tested Our Restore Capabilities Recently?

Data backups are vital for disaster recovery, but their effectiveness hinges on their isolation and the ability to restore data quickly and accurately. Regularly testing the restore process and ensuring that backups are isolated can prevent data loss during a cyber incident. Discuss the status of your data backup strategy and recent test results with your IT team to ensure preparedness.

Key Points:

• Ensure backups are isolated from the main network.
• Conduct regular restore tests.
• Stay informed about the latest backup technologies and practices.

3. How Is Our Organizational Culture Impacting the Effectiveness of Our Cybersecurity Controls?

A strong cybersecurity culture can enhance the effectiveness of security measures. Evaluate how your organization's culture supports or hinders cybersecurity practices. Collaborate with your IT team to foster a security-minded environment, ensuring that cybersecurity is a shared responsibility across all departments.

Key Points:

• Assess the current cybersecurity culture.
• Promote security awareness and training.
• Encourage open communication about security issues.

4. Are Our Employees Actively Reporting Phishing Attempts?

Employee vigilance is critical in combating phishing attacks. Ensure your IT department tracks phishing reports and provides regular feedback and training to employees. Maintaining high awareness and responsiveness can significantly reduce the risk of successful phishing attempts.

Key Points:

• Implement regular phishing awareness training.
• Track and analyze phishing reports.
• Provide feedback to employees to improve detection and response.

5. Do We Have Adequate Cybersecurity Insurance Coverage to Protect Against Potential Losses?

Cybersecurity insurance is an essential part of risk management. Work with your IT and insurance teams to assess your current coverage and identify any gaps that could expose your organization to significant financial risk. Adequate coverage ensures that your organization can recover more quickly from cyber incidents.

Key Points:

• Review your cybersecurity insurance policy regularly.
• Identify potential coverage gaps.
• Ensure your policy aligns with your risk management strategy.

6. Do Our Security Policies and Standards Contain Language That Could Be Weaponized Against Us?

Clear and precise language in your security policies is crucial to avoid misinterpretation. Regularly review your policies with your IT and legal teams to ensure they are comprehensive and cannot be used against your organization. This practice helps maintain compliance and protect against legal liabilities.

Key Points:

• Conduct regular policy reviews.
• Collaborate with legal and IT teams.
• Ensure policies are clear, precise, and up-to-date.

7. Are We Effectively Managing Third-Party Risks?

Vendors and third-party partners can introduce significant cybersecurity risks. Ensure your IT team is rigorously vetting these entities and that robust agreements are in place to manage these risks. Effective third-party risk management safeguards your organization from vulnerabilities outside your direct control.

Key Points:

• Implement a thorough vetting process for third parties.
• Establish clear agreements and security requirements.
• Monitor third-party compliance regularly.

8. How Are We Securing Our Remote Work Infrastructure?

With the rise of remote work, securing remote access points is more important than ever. Ensure your IT team has implemented strong VPNs, multi-factor authentication, and other security measures to protect remote operations. Secure remote work infrastructure is essential for maintaining business continuity and protecting sensitive information.

Key Points:

• Use strong VPNs and MFA for remote access.
• Regularly update and patch remote access tools.
• Provide training on secure remote work practices.

9. What Measures Are in Place to Protect Our Sensitive Data?

Protecting sensitive data is crucial to maintaining client trust and regulatory compliance. Discuss with your IT department about data encryption, access controls, and regular security audits to safeguard your information. Effective data protection strategies help prevent data breaches and ensure compliance with data protection regulations.

Key Points:

• Implement robust data encryption and access controls.
• Conduct regular security audits.
• Stay informed about data protection regulations.

10. Do We Have a Strategy for Maintaining Business Continuity After a Cyber Incident?

A cyber incident shouldn't halt your business operations. Work with your IT team to develop and regularly test a business continuity plan that ensures critical functions can continue during and after a cyber attack. A well-prepared continuity plan helps minimize downtime and maintain essential operations. Managed Detection and Response (MDR) providers can also help in quickly identifying and remediating ongoing threats.

Key Points:

• Develop and test a business continuity plan.
• Ensure all critical functions are covered.
• Regularly update the plan to address new threats.

Defensible - Your Trusted Partner in Managing Cybersecurity Risk

Defensible Technology is a risk-based and security-first IT service provider, focused on delivering world-class solutions, assessments, and advisory to SMB and mid-market customers, all at an affordable price.  Defensible is the trusted IT partner and Managed Service Provider for security-minded businesses.

Our expertise comes from decades of diverse technical and cybersecurity experience and backgrounds in large-scale, complex environments.  We regularly work with General Counsels and legal teams to help them navigate the intricacies of cybersecurity compliance, develop comprehensive incident response plans, and ensure that their organizations are well-prepared to handle potential cyber threats. 

Contact us now for a free, non-obligatory consultation to see first-hand what we can do for your organization.