What's Happening?

Facebook Twitter Youtube Linkedin

NEED HELP? QUESTIONS@FIA.ORG.ZA

become A FIA member TODAY
member login

How exposed are directors personally in the face of a cyber attack?

ARTICLE BY

  • Candice Sutherland

SHARE THIS POST

The views expressed in this article are not necessarily those of the FIA. The article below was supplied by 2018 FIA partner, ITOO Special Risks.

Anyone who sells directors and officers liability products will know that the responsibility for a company’s financial, reputational and operational success ultimately lies with its directors. When joining the board, these individuals undertake to manage the business with due care, skill and diligence. This includes safeguarding the organisation against cyber breaches.

A breach is an incident in which sensitive, protected or confidential information is either stolen, copied, transmitted, viewed or used by an unauthorised party. A company’s directors have a lot to be concerned about following a cyber breach. The most obvious concern would be around expenses, including response and remediation costs and consequential loss of bottom-line revenue. They would also need to consider the impact on their clients, as well as employee relationships.

It is therefore  imperative for any board to proactively manage cyber security, which includes driving awareness and creating readiness for a cyber security incident. It is extremely difficult, if not impossible, for anyone who doesn’t work fulltime in cyber security to keep up with the ever-changing threat landscape. Directors are increasingly being named as defendants in costly and intrusive litigation. Saying, “I didn’t have enough information” or, “I didn’t quite understand the risk” is not an adequate defence.

The failure to implement appropriate cyber security risk management measures could, in fact, constitute a breach of directors’ fiduciary duties. These fiduciary duties are codified in the Companies Act (No. 71 of 2008). A breach could lead to claims being brought against directors and executives in their personal capacities.

The South African Companies Act stipulates that any person who contravenes any section of the Act is liable to any other person for any loss or damage suffered by that person as a result of that contravention. These are some of the potential pitfalls:

Regulatory action

Depending on the regulatory framework and industry within which the company operates, complaints can be made to the Companies and Intellectual Property Commission (CIPC), which will in turn investigate and allow action to be taken against a company or its directors.

Right to privacy

Directors and executives may face personal liability as a result of having breached privacy law in South Africa, including the Protection of Personal Information Act (No. 3 of 2013), also known as POPI. Depending on the nature of the contravention, a director could face civil fines, administrative fines, penalties and even a period of imprisonment.

Technology and information governance

According to Principle 12 of King IV, the governing body must oversee that the IT responsibilities are managed, appropriately resourced and sufficiently defined.

Shareholder action

Shareholders may sue directors for a decrease in the share price following a breach, as well as the costs involved and reputational or brand damage.

Client action

Those affected by a cyber breach can hold the corporation’s management and board accountable as they might feel that the corporation failed to address weaknesses in its systems and programs.

Here are a few good corporate governance tips for brokers to share with corporate clients that can help to protect directors and executives from personal liability in the event of a cyber attack:

  • Ensure cyber security and data privacy matters are appropriately addressed at board meetings. Depending on the organisation, this would include, but not be limited to:
    • Understanding data security legislation such as POPI, GDPR etc., and how they impact the organisation
    • Making appropriate appointments in terms of data security officers if required (Interestingly, a 2017 study by Ponemon found that the appointment of a chief privacy officer significantly decreased the per capita cost of a cyber breach, the average cost of which was R32 million)
    • Seeking expert advice around minimum security requirements
    • Ensuring adequate resources are made available to implement and maintain security
    • Implementing reporting and monitoring requirements in the event of a breach
  • Maintain a high level of cyber awareness. Around 29% of cyber breaches are caused by human error. Strong security practices can minimise the possibility of successful attacks
  • Have a breach response plan in place – and have printed copies readily available (the plan should not only be saved electronically in case the attack leaves you locked out of your systems)
  • Put systems, personnel and software in place that can detect a security breach promptly
  • Hire third party consultants to audit the security systems through vulnerability scans or penetration tests and ask ask for recommendations to improve your network
  • Make sure the board is aware of their disclosure obligations. Failure to disclose increases the risk that clients may bring an action against the board and the company
  • Act promptly by conducting a post-breach review. Assess security gaps and evaluate the effectiveness of the corporation’s current policies and procedures. This may include updating technology controls and policies and procedures, revisiting existing plans, and making appropriate changes

A fundamental aspect of corporate governance is to have a strong cyber risk management programme in place. This would include cyber and D&O cover to protect both the interests of the business itself and the directors and executives in their personal capacities. Cyber Insurance provides comprehensive cover to respond to a network security or privacy breach. Cover extends from the incident response process through to business interruption losses and the defence and settlement of ensuing liability claims.

D&O insurance typically covers the following:

  • Directors & Officers – Provides cover for non-indemnified events – i.e. protects a director against personal liability or expenses not paid for by the company, and advances defence costs
  • Company Reimbursement – Reimburses the company when the company has indemnified a director for an insured event, including any defence costs and expenses
  • Company Securities – Cover for the entity where it is joined as a defendant with the directors in respect of actions relating to breach of securities regulation

Subscriber Terms and Conditions

  1. APPLICATION OF TERMS
    • These terms and conditions (“Subscriber Terms”) apply to the subscription by any qualifying member of the South African Underwriting Managers Association NPC (“SAUMA”) to the services and benefits offered by FIA Services (Pty) Ltd (“FIA Services”) under the SAUMA affiliation arrangement (“Subscription”).

  2. NATURE OF SUBSCRIPTION
    • A Subscription under this arrangement:
      • does not constitute membership of FIA NPC;
      • does not confer any voting rights or governance participation in FIA NPC; and
      • is governed solely by the contractual relationship between the Subscriber and FIA Services.

  1. ELIGIBILITY
    • To qualify for the Subscription, the applicant must, at the time of application, be a current paid-up member of SAUMA.
    • FIA Services will verify the applicant’s SAUMA membership status with SAUMA prior to activation, and may re-verify such status periodically.
    • If a Subscriber ceases to be a paid-up member of SAUMA, the Subscription will correspondingly be terminated.
    • Applicants are required to authorise FIA Services to confirm their SAUMA membership status with SAUMA as part of the application process.

  1. SERVICES
    • The Subscription entitles the Subscriber to the following benefits:
      • Complimentary access to the FIA CPD Platform;
      • Complimentary access to the FIA Insight Magazine (digital edition);
      • Advertising opportunities on FIA platforms at a discounted rate of 15% (fifteen percent) off the prevailing published rates; and
      • Invitations to attend FIA Technical Webinars annually.
    • FIA Services reserves the right to update, vary or substitute the Services from time to time, provided that the overall value and nature of the benefits remain materially the same.

  1. FEES AND PAYMENT
    • The monthly subscription fee is R260.00 (two hundred and sixty rand) for up to seven registered individuals (Key Individuals and Representatives), and R36.00 (thirty-six rand) per additional registered individual thereafter, excluding VAT.
    • The Subscriber shall provide FIA Services with the required details of each individual to be registered under the Subscription for the purposes of activation and billing.
    • All fees are exclusive of VAT, which shall be charged at the prevailing statutory rate.
    • Subscription fees are reviewed annually in March and may be adjusted with effect from 1 April.
    • Any changes to the Subscription, including but not limited to the number of Representatives and Key Individuals registered under the Subscription, may only be effected once annually during the annual review period in March of each year, with such changes taking effect from 1 April.
    • Subscription fees shall be billed monthly in arrears, unless the Subscriber elects an annual billing cycle at the time of application.
    • The Subscriber shall ensure that all billing information (including contact details, authorised signatories and bank account details) is kept accurate and up to date.
    • Non-payment of subscription fees may result in suspension of access to the Services until such fees are brought up to date.
    • The Subscriber acknowledges and agrees that all subscription fees payable under these Subscriber Terms may be collected by way of debit order, which shall be processed by the holding company, FIA NPC (The Financial Intermediary Association of South Africa), on behalf of FIA Services. Payment to FIA NPC shall be deemed to constitute valid and sufficient discharge of the Subscriber’s payment obligations to FIA Services under these Subscriber Terms.

  1. ONBOARDING
    • Onboarding will be conducted as a Subscription with FIA Services under the SAUMA affiliation arrangement.
    • Onboarding will not confer FIA NPC membership status or any associated rights.
    • Onboarding is conditional on confirmation of the Subscriber’s current SAUMA membership at the time of application

  1. DATA PROTECTION
    • FIA Services will process all personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA) as set out in our POPIA policies.
    • By subscribing, the Subscriber authorises FIA Services to confirm their SAUMA membership status with SAUMA and to process personal information for the purposes of fulfilling the Subscription.

  1. TERMINATION
    • The Subscriber may terminate the Subscription by giving FIA Services one calendar month’s written notice.
    • FIA Services may terminate the Subscription on one calendar month’s written notice, or immediately if the Subscriber breaches these Subscriber Terms and fails to remedy such breach within 14 (fourteen) days of receiving written notice.
    • Termination of the SAUMA–FIA Services affiliation agreement shall not automatically terminate these Subscriber Terms.
    • Termination by the Subscriber shall not relieve the Subscriber of liability for any subscription fees accrued up to the effective date of termination.
    • FIA Services may suspend or terminate the Subscription with immediate effect in the event of non-payment of fees by the Subscriber.

  1. GENERAL
    • These Subscriber Terms are governed by the laws of the Republic of South Africa.
    • Any disputes arising under these Subscriber Terms shall be dealt with in accordance with the dispute resolution provisions contained in the FIA NPC membership terms and conditions, as modified to reflect that the contractual relationship is with FIA Services.
    • Any notices required under these Subscriber Terms may be validly delivered by email to the addresses provided in the Subscriber’s application form, and such notices shall be deemed received on the day of transmission if sent during business hours.
    • The Subscriber may not assign, cede or transfer any of its rights or obligations under these Subscriber Terms without the prior written consent of FIA Services.
    • No variation of these Subscriber Terms shall be of any force or effect unless reduced to writing and signed by both FIA Services and the Subscriber.