Government Action and HR’s Role in Cybersecurity
Cybersecurity continues to be a pressing concern, prompting government action and new regulations. The proposed federal backstop aims to help insurers stay financially stable after a catastrophic cyberattack. Additionally, the Securities and Exchange Commission has adopted new cybersecurity disclosure rules, requiring public companies to report cybersecurity incidents within four days.
While these actions are well-known, the critical role that HR professionals play in mitigating cyber breaches within organizations is often overlooked. Surprisingly, 85% of all cyber incidents involve a human element. Experts estimate that 78% of work-related cyber claims start with phishing exercises, where employees receive fraudulent emails or texts from seemingly reputable sources. By collaborating with IT on awareness building, training, policies, and pre-breach planning, HR can effectively prevent bad actors from breaching organizations.
Given the vast amount of data handled by HR professionals, it is crucial for them to educate their company and implement strong controls within their own departments to mitigate the risk of cybercrime.
The growth in risk factors has been significant since 2020, largely due to the transformation in office culture caused by the COVID-19 pandemic. With employees working from home and using various networks, new vulnerabilities have emerged for bad actors to exploit. Hackers have become more sophisticated, generating phishing emails from within an organization’s email database with fully recognizable addresses.
To combat these threats, workforce awareness and training are key. HR should incorporate cyber education into onboarding and continuing education programs. Continuous training ensures employees have the latest information to protect the organization. Some companies even incentivize employees who detect and report phishing schemes.
HR professionals themselves can also be attractive targets for hackers due to their access to sensitive employee and company data. Implementing proactive policies, such as verifying requests for changes to sensitive information and incident response protocols, is essential for HR leaders.
Pre-breach planning and policy templates are crucial elements of cyber insurance. Construction and manufacturing, previously considered low-risk industries, now have the highest cyber insurance claim frequency. This highlights the importance of investing in pre-breach planning, regardless of industry.
Expect to see an increase in cyber regulations in the coming years. Currently, certain industries like higher education and healthcare have specific cyber regulations in place. States, such as California, have also passed cybersecurity laws. While regulations play a role in raising awareness, they cannot replace organizational planning and preparation.
Proactive preparation remains the best defense for HR professionals. However, there is still a significant exposure gap in insurance protection and pre-breach planning. As breaches and regulations increase, more HR leaders are seeking proactive planning and protection solutions. This presents an opportunity for cyber-specialist brokers to provide best practices and risk mitigation strategies.
In conclusion, HR professionals have a crucial role to play in cybersecurity. By prioritizing awareness, training, and policies, HR can effectively protect organizations from cyber threats. With the understanding that every employee is a critical risk factor, C-suite executives are increasingly seeking guidance from HR to prevent cyber breaches at an enterprise level.