What happens in the case of the inevitable – a cyberattack? What is the first recourse? This came up when a leading advocate who is also a leading cybersecurity counsel to organizations and works with the Government too – broached this thought during a conference. He observed that most CISOs will need legal first aid before any formal legal action kicks in – before he pushes the panic button, he needs to push the right help button.

So, the idea of a CISO legal helpline per se is not new. For many years, CISOs were measured against an impossible objective: 100% breach prevention or face the Damocles sword. Thankfully, many today understand there is no such thing as 100% protection against breaches. This has changed how CISO effectiveness is gauged: from breach prevention to incident response and resilience.

This change is welcome, because incident response and resilience are largely under the control of the CISO.

In a world where no organization is 100% protected from security compromise, creating an effective incident response (IR) plan is perhaps the most important job of the CISO. And while no two enterprises are alike, there are common approaches every security organization should build into their IR plans. The first is to understand that a data breach is not just a cybersecurity issue – it’s a corporate crisis issue and should be treated as such.

And, as with any corporate crisis, there should be a predefined cross-functional team in place to execute on the IR plan.

Having said this, in the event of an incident, the threat of litigation is enough to keep any business leader up at night, and the increasing prevalence of data protection, privacy, and cybersecurity legislation and regulation is piling on the pressure for CISOs.

ETCISO conducted a quick LinkedIn poll to understand from its followers what or who is the CISO most likely to seek first recourse with in the event of an incident – and interestingly among the four choices that were given, it turns out that a CISO is most likely to talk to the CIO/CTO of the organization, with 62 percent of the respondents stating so.

In the US, with the conviction of former Uber CISO Joe Sullivan and civil charges against SolarWinds CISO Tim Brown, it seems many CISOs are realizing they can be held personally liable for improperly handling cyber incidents. The precedent set by the Sullivan and Brown cases have put CISOs on high alert about their potential personal liability. Beyond financial penalties or career implications, CISOs now face potential civil, criminal charges and jail time for inadequately responding to and reporting incidents. And other C-level executives are in-scope for being personally liable.

In India, with regulatory authorities clamping down tightly, it is also well known that an organization (a data center, a service provider or an enterprise) is mandated to report an incident to CERT-IN in less than 6 hours. CISOs are under pressure and there are no two ways about it.

I took the liberty of checking further with a few CISOs, and as many as half a dozen of them I had specific conversations around this unanimously agreed that they have full fledged legal recourse through legal and compliance teams. So, while they were definitely concerned about the personal and professional damage an incident would do to them, they were more concerned about addressing the incident quickly and saving their organization from further reputational and cyber harm. And at that point, large organizations talk to core teams, particularly to their CIO and the CEO at quick speed. Then, legal teams kick in.

Do they need a legal helpline? Smaller organizations, yes, the ones that are standing on their feet would find great leverage with a helpline. But, at the end of it, while dystopia sets in, CISOs are better off with a solid IR plan, quick buy-in from their CEO and their CIO.