Attacks on Marks & Spencer and the Co-op should be a wake-up call for other businesses, including SMEs, writes SCOTT MONCUR
Some weeks on from the headline grabbing news of cyberattacks on M&S and the Co-op, anyone who still believed that cybersecurity is a technical risk, would only have needed to wander into a Co-op store and gaze along its empty shelves, or try to order something online from M&S, to find their view altered.
These recent events bring home the reality that cybersecurity is a critical business, legal, and regulatory issue, with the experiences of these retailers underscoring the operational impact of the legal risks that businesses face when managing sensitive data.
M&S faced customer data leaks, and was forced to suspend customer online ordering, which represents a valuable part of its service offer, but is still weeks away from being up and running again.
The Co-op, with its vast network of stores, closed its systems to prevent further cybersecurity attack, impacting supply chain delivery, stock control, and employee working arrangements.
The experiences of both retailers highlight how robust cybersecurity measures are needed in operational and legal frameworks to protect business from the shock of a cyber incident. And both illustrate the impact cybersecurity breaches can have on customer service, confidence and trust in a brand.
And, of course, it’s not just larger companies that are at risk. Small and medium-sized enterprises (SMEs) are vulnerable to cyber threats too, but often have fewer resources at their disposable to mitigate the risks.
Cybersecurity failings can create severe issues both financially and reputationally and these carry significant legal consequences. Key areas of focus for businesses include:
Data protection and GDPR compliance
The UK General Data Protection Regulation (GDPR) mandates stringent data protection measures for personal data, and there is a commercial expectation that SMEs can keep digital assets safe. SMEs operating digitally should implement robust security protocols as failure to do so can lead to hefty fines and legal liabilities.
Contractual and third-party liabilities
SMEs often outsource IT services or rely on third-party vendors for data management. If a cybersecurity incident originates from a third party, determining who does what to resolve the situation and sort out liability can be complex.
Supply chain management and incident planning are minimum benchmarks for SMEs to adopt. It is often called business continuity or disaster planning. Contracts should clearly define responsibilities and liabilities in the case of a cyber incident, and it is always useful to walk through the plans to see how they would work in practice.
Intellectual property (IP) theft and fraud
Cybersecurity breaches can expose sensitive business information and trade secrets in any size of organisation. SMEs should ensure the security of proprietary information through encryption and legal safeguards.
Financial fraud and transaction security
SMEs engaged in e-commerce are vulnerable to fraud. Legal liabilities arise where there is failure to safeguard consumer financial data. Learning from the incidents of large retailers and implementing secure payment processing systems and legal frameworks to prevent fraud claims, is essential.
The value of expert professional support
While cybersecurity and appropriate measures to maintain it should be part of every business’s management agenda and its regular reporting schedule, independent verification from professional support can play a key role in helping SMEs anticipate the tenacity of cybersecurity risks.
Legal risk experts can provide strategic and practical support and guidance through GDPR and other cybersecurity regulations, ensuring firms meet compliance requirements, avoid penalties, and have in place a working governance risk compliance framework that embeds cybersecurity into a company’s operational framework.
Legal support can also help develop training and legal awareness around (in)advertent causes of security breaches, and in the event of a cyber breach, legal support can help manage incident response and crisis management, regulatory reporting, and potential lawsuits.
The scale of what is required to achieve cybersecurity, and operational resilience, might appear daunting for smaller businesses but the good news is that there is professional support and advice available. And the return on that investment should prove to be invaluable.
Scott Moncur is a senior legal director at Vialex
>Latest Daily Business news
Leave a Reply