Obligation

In the context of cybersecurity, an obligation is a binding requirement or duty that an entity must fulfill to maintain the confidentiality, integrity, and availability of information, and to safeguard personal data. These obligations can arise from various sources, including international, national, and local laws, industry-specific regulations, contractual agreements with third parties, and an organisation's internal policies and ethical commitments. The scope and nature of these obligations vary significantly based on the industry, geographic location, and types of data handled.

What are cybersecurity obligations?

Cybersecurity obligations are the mandatory duties and responsibilities imposed on organisations and individuals to protect information assets, ensure data privacy, and maintain the security of digital systems. These obligations stem from multiple sources:

• Legal and regulatory requirements: Laws such as the General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA), and the California Consumer Privacy Act (CCPA) establish specific duties regarding data protection, breach notification, and individual privacy rights.
• Industry-specific regulations: Standards such as PCI DSS for payment card data and NERC CIP for critical infrastructure impose sector-specific security requirements.
• Contractual agreements: Obligations may arise from service-level agreements, data processing agreements, and other contractual arrangements with third parties.
• Internal policies and ethical commitments: Organisations often establish their own security policies that create binding internal obligations for employees and stakeholders.

Why are cybersecurity obligations important?

Cybersecurity obligations are critically important for several reasons:

• Legal compliance: Non-compliance with regulatory obligations can result in substantial fines, legal actions, and sanctions. For example, GDPR violations can lead to penalties of up to €20 million or 4% of annual global turnover.
• Protection of sensitive data: Obligations ensure that organisations implement adequate measures to protect personal data, intellectual property, and other sensitive information from unauthorised access or disclosure.
• Trust and reputation: Fulfilling cybersecurity obligations builds trust with customers, partners, and stakeholders, safeguarding an organisation's reputation in the marketplace.
• Operational continuity: By adhering to security obligations, organisations reduce the risk of disruptive cyber incidents that could impact business operations and service delivery.
• Risk mitigation: Structured obligations provide a framework for identifying, assessing, and mitigating cybersecurity risks systematically.

How to manage cybersecurity obligations?

Effectively managing cybersecurity obligations requires a structured and continuous approach:

• Conduct risk assessments: Regularly assess threats, vulnerabilities, and the potential impact of security incidents on your organisation's information assets.
• Implement technical and organisational measures: Deploy appropriate controls such as encryption for personal data (as required under GDPR and HIPAA), access controls, firewalls, and intrusion detection systems.
• Adopt recognised frameworks: Leverage established frameworks from organisations like the National Institute of Standards and Technology (NIST) and the International Organization for Standardization (ISO 27000 series) to structure your compliance efforts.
• Provide employee training: Ensure all personnel understand their roles and responsibilities regarding cybersecurity through regular training and awareness programmes.
• Monitor and improve continuously: Establish continuous monitoring of security postures and conduct periodic audits to identify gaps and drive improvements.
• Document and track obligations: Maintain a comprehensive register of all applicable obligations, their sources, and the measures in place to address them.

When do breach notification obligations apply?

Breach notification obligations are triggered when a security incident results in the unauthorised access, disclosure, or loss of protected data. The specific requirements vary by jurisdiction and regulation:

• GDPR: Requires organisations to notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach. Affected individuals must also be notified without undue delay if the breach poses a high risk to their rights and freedoms.
• CCPA: Mandates that businesses notify affected California residents of data breaches involving unencrypted personal information in a timely manner.
• HIPAA: Requires covered entities to notify affected individuals within 60 days of discovering a breach of unsecured protected health information, and to report to the U.S. Department of Health and Human Services.

For example, notifying authorities and affected individuals of a data breach within a specified timeframe is a core obligation under both GDPR and CCPA. Organisations should have incident response plans in place to ensure these obligations are met promptly and effectively.

Which cybersecurity frameworks address obligations?

Several widely recognised cybersecurity frameworks provide structured guidance for meeting security obligations:

• NIST Cybersecurity Framework (CSF): Developed by the National Institute of Standards and Technology, this framework provides a comprehensive set of guidelines for managing cybersecurity risks, organised around five core functions: Identify, Protect, Detect, Respond, and Recover.
• ISO/IEC 27001 and the ISO 27000 series: Published by the International Organization for Standardization, these standards specify requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS).
• PCI DSS: The Payment Card Industry Data Security Standard defines security requirements for organisations that handle credit card data.
• NERC CIP: The North American Electric Reliability Corporation Critical Infrastructure Protection standards address cybersecurity obligations for entities operating bulk electric systems.
• SOC 2: A compliance framework developed by the American Institute of CPAs (AICPA) that focuses on the security, availability, processing integrity, confidentiality, and privacy of customer data.

By aligning with these frameworks, organisations can systematically address their cybersecurity obligations, demonstrate compliance to regulators and stakeholders, and strengthen their overall security posture.