Elevator Speeches for Business Leaders - Final Draft for November 2007 CSI Alert - Security and Compliance Risk Answers

Sep 4, 2026

Upload by Mabel

Elevator Speeches for Business Leaders (Final Draft for November 2007 CSI Alert) provides ready-to-use, CEO-facing guidance on recurring information security, privacy, and compliance questions. It explains executive personal exposure under data protection and security laws, tying effective controls to risk assessments covering customer and PII data and the systems that process and store them. It also outlines practical steps to launch enterprise risk management, stressing executive sponsorship, a capable program team, and using established frameworks like COSO, COBIT, and ISO 27002.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages6

Reading Time15 min

AccessFree to download

What are the personal risks for executives when security controls or data protection compliance fail?

Legal and regulatory drivers

Executive and organizational accountability

What approach should business leaders take to start effective risk management?

Executive sponsorship and organization-wide involvement

Building the right team

Using proven risk management frameworks

Elevator Speeches for Business Leaders Rebecca Herold, CIPP, CISSP, CISA, CISM, FLMI Final Draft for November 2007 CSI Alert Over the years I have had the great opportunity to speak with many business leaders in the CxO positions, along with many information security and privacy practitioners. I have found some of the topics and questions to be noticeably recurring. This month I want to discuss some of these frequently asked questions. Business leaders across the board want to know about these information security, privacy and compliance topics. Know how to answer them when your CEO, or other CxO, is in the elevator with you, or behind you in line at the cafeteria. 1. What are the personal risks that business executives face if they fail to implement effective security controls or do not comply with data protection regulations? It is important for business leaders to first understand there are many laws and regulations requiring information security programs; some directly and some indirectly. These information security programs must be built based upon risk assessments related to safeguarding customer and personally identifiable information (PII) information, along with the systems where they are processed and stored. In the U.S. the laws and regulations include, but are not limited to, the USA PATRIOT Act, the Sarbanes Oxley Act (SOX), the Gramm-Leach Bliley Act (GLBA), the Health Insurance Portability and Accountability Act (HIPAA), the Federal Trade Commission Act (FTC Act), and the Fair and Accurate Credit Transactions Act (FACTA) . Many of the regulatory oversight agencies provide clarification for specifically what they are looking for with regard to compliance. For example, in the financial industry the FFIEC IT Examination Handbook, the FDIC IT Examination Workpaper, the OTC Consumer Regulations Handbook, the Federal Reserve Commercial Banking Handbook, the NCUA Regulatory Compliance Handbook, and the OCC Examination Booklet for Privacy of Consumer Financial Information all describe the importance and responsibilities of executive leaders to ensure security is in place. In addition to the U.S. federal laws, there are at least 39 state level breach notice laws, hundreds of other state laws addressing data protection, and contractual obligations, such as PCI DSS and those contracts business partners have with your organization. Outside the U.S. there are over 100 country-level data protection laws. Business leaders must work with the organization’s board of directors, or an appropriate committee of the board, to satisfy specific requirements designed to ensure that the institution’s information security program is developed, implemented, and maintained. The executives and board are ultimately, personally, responsible in many cases. As just one example, under SOX the executive leaders of any publicly traded organization in the U.S. are personally liable for shortcomings in compliance requirements and face not only penalties but also jail time. The financial institution also faces not only penalties, but also bad publicity and lost customers. © 2007 Rebecca Herold, CIPP, CISSP, CISM, CISA, FLMI. All rights reserved. The bottom line 30-second elevator speech for this topic that you could use follows: You, as our organization’s business leader, are ultimately responsible for ensuring we have a strong security program in place. If you don’t, you personally could get substantial fines and penalties, even including jail time. You also subject our organization to significant fines and penalties, civil suits, diminished brand value, lost customers, and possibly the loss of our business. 2. What approach should business leaders take to start an effective risk management program? First and foremost, an organization needs to have strong support from executive leaders. Implementing a risk management program will involve personnel from throughout the organization, so it is important for executive leaders

FAQs

What personal risks do business executives face if they fail to implement effective security controls or comply with data protection regulations?

Executives can face substantial fines and penalties, and in some cases personal liability that may include jail time. Organizations may also suffer penalties, civil suits, reputational damage, and lost customers.

How should business leaders structure an information security program to meet legal and regulatory requirements?

Security programs should be built based on risk assessments focused on safeguarding customer and personally identifiable information (PII), and on the systems where that data is processed and stored. Leaders should also align the program with applicable laws and regulatory guidance.

What is the recommended first step for starting an effective risk management program?

Obtain strong support from executive leadership and communicate the importance of risk management to all personnel, ensuring organization-wide involvement. Visible executive sponsorship is presented as essential for program success.

Sep 4, 2026

Upload by Mabel