Directors' Responsibilities
Directors' Responsibilities
Exposure overview
An emerging exposure for many company directors in Australia, due to their duty to create and maintain cyber resilient enterprises. Directors and officers can be held personally liable for decisions and actions related to cybersecurity.
The Law
Australian directors have significant legal responsibilities regarding cyber risk. Here are some key points:
- Duty of Care and Diligence: Under Section 180 of the Corporations Act 2001, directors must act with reasonable care and diligence. This includes being proactive about cyber security and ensuring that appropriate measures are in place to protect the company's data and systems.
- Privacy Obligations: Directors must comply with the Privacy Act 1988, which includes the Notifiable Data Breaches scheme.
- ASIC's Focus: Directors of entities that hold an Australian Financial Services License (“AFSL”) are also subject to general and specific obligations under the Corporations Act. The Federal Court of Australia consent orders in ASIC v RI Advice, confirmed this includes having in place risk management systems and controls to manage business risks.
Scale of the problem
Director's liability for cyber breaches is a growing exposure. With the increasing frequency and severity of cyber attacks, regulators and stakeholders are placing more emphasis on the accountability of directors and officers for cyber security measures.
Exposure Mitigation
Directors and senior officers need to proactively tackle oversight and management of cyber risk. Mitigation should be considered with their wider security programme and the advice received from their IT security adviser:
- Set clear roles and responsibilities at board level.
- Develop, implement and evolve a cyber strategy.
- Embed cyber security in risk management practices.
- Promote a culture of cyber resilience.
- Plan for a cyber-security incident.
Insurance Solution
Any Damages or Defence Expenses, that any director or officer of the Insured, is legally obligated to pay in respect of any actual or alleged error, omission, misstatement, misleading statement, neglect or breach of duty, arising out of a Third Party Claim against any director or officer of the Insured, while they are acting in their capacity during the Period of Insurance, provided that the Third Party Claim is a direct result of a Security Breach or Privacy Breach.
