[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-202705-105":59,"doc-detail-202705-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","elevator-speeches-for-business-leaders-final-draft-for-november-2007-csi-alert-security-and-compliance-risk-answers","Elevator Speeches for Business Leaders - Final Draft for November 2007 CSI Alert - Security and Compliance Risk Answers","","Elevator Speeches for Business Leaders (Final Draft for November 2007 CSI Alert) provides ready-to-use, CEO-facing guidance on recurring information security, privacy, and compliance questions. It explains executive personal exposure under data protection and security laws, tying effective controls to risk assessments covering customer and PII data and the systems that process and store them. It also outlines practical steps to launch enterprise risk management, stressing executive sponsorship, a capable program team, and using established frameworks like COSO, COBIT, and ISO 27002.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":30,"@type":76,"position":81},"https://docshare.wps.com/document/technology/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/elevator-speeches-for-business-leaders-final-draft-for-november-2007-csi-alert-security-and-compliance-risk-answers/202705/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/elevator-speeches-for-business-leaders-final-draft-for-november-2007-csi-alert-security-and-compliance-risk-answers/202705.png","ImageObject",300,407,{"name":92,"@type":93},"Mabel","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-19","2026-09-04",true,{"@type":102,"interactionType":103,"userInteractionCount":34},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"What personal risks do business executives face if they fail to implement effective security controls or comply with data protection regulations?","Question",{"text":112,"@type":113},"Executives can face substantial fines and penalties, and in some cases personal liability that may include jail time. Organizations may also suffer penalties, civil suits, reputational damage, and lost customers.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"How should business leaders structure an information security program to meet legal and regulatory requirements?",{"text":117,"@type":113},"Security programs should be built based on risk assessments focused on safeguarding customer and personally identifiable information (PII), and on the systems where that data is processed and stored. Leaders should also align the program with applicable laws and regulatory guidance.",{"name":119,"@type":110,"acceptedAnswer":120},"What is the recommended first step for starting an effective risk management program?",{"text":121,"@type":113},"Obtain strong support from executive leadership and communicate the importance of risk management to all personnel, ensuring organization-wide involvement. Visible executive sponsorship is presented as essential for program success.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},202705,1790667120,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":29,"category_name":30,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":34,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":29,"language":139,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":140,"faqs":141,"seo_title":142,"seo_description":67,"update_tm":143,"read_time":144},7971474920318,"https://ap-avatar.wpscdn.com/avatar/74000ee537e6b0ca360?x-image-process=image/resize,m_fixed,w_180,h_180&k=1788430171632181674","Elevator Speeches for Business Leaders  \nRebecca Herold, CIPP, CISSP, CISA, CISM, FLMI  \nFinal Draft for November 2007 CSI Alert  \nOver the years I have had the great opportunity to speak with many business leaders in the CxO positions, along with many information security and privacy practitioners. I have found some of the topics and questions to be noticeably recurring. This month I want to discuss some of these frequently asked questions. Business leaders across the board want to know about these information security, privacy and compliance topics. Know how to answer them when your CEO, or other CxO, is in the elevator with you, or behind you in line at the cafeteria.  \n1. What are the personal risks that business executives face if they fail to implement effective security controls or do not comply with data protection regulations?  \nIt is important for business leaders to first understand there are many laws and regulations requiring information security programs; some directly and some indirectly. These information security programs must be built based upon risk assessments related to safeguarding customer and personally identifiable information (PII) information, along with the systems where they are processed and stored.  \nIn the U.S. the laws and regulations include, but are not limited to, the USA PATRIOT Act, the Sarbanes Oxley Act (SOX), the Gramm-Leach Bliley Act (GLBA), the Health Insurance Portability and Accountability Act (HIPAA), the Federal Trade Commission Act (FTC Act), and the Fair and Accurate Credit Transactions Act (FACTA) .  \nMany of the regulatory oversight agencies provide clarification for specifically what they are looking for with regard to compliance. For example, in the financial industry the FFIEC IT Examination Handbook, the FDIC IT Examination Workpaper, the OTC Consumer Regulations Handbook, the Federal Reserve Commercial Banking Handbook, the NCUA Regulatory Compliance Handbook, and the OCC Examination Booklet for Privacy of Consumer Financial Information all describe the importance and responsibilities of executive leaders to ensure security is in place.  \nIn addition to the U.S. federal laws, there are at least 39 state level breach notice laws, hundreds of other state laws addressing data protection, and contractual obligations, such as PCI DSS and those contracts business partners have with your organization. Outside the U.S. there are over 100 country-level data protection laws.  \nBusiness leaders must work with the organization’s board of directors, or an appropriate committee of the board, to satisfy specific requirements designed to ensure that the institution’s information security program is developed, implemented, and maintained. The executives and board are ultimately, personally, responsible in many cases.  \nAs just one example, under SOX the executive leaders of any publicly traded organization in the U.S. are personally liable for shortcomings in compliance requirements and face not only penalties but also jail time. The financial institution also faces not only penalties, but also bad publicity and lost customers.  \n© 2007 Rebecca Herold, CIPP, CISSP, CISM, CISA, FLMI. All rights reserved.  \nThe bottom line 30-second elevator speech for this topic that you could use follows:  \nYou, as our organization’s business leader, are ultimately responsible for ensuring we have a strong security program in place. If you don’t, you personally could get substantial fines and penalties, even including jail time. You also subject our organization to significant fines and penalties, civil suits, diminished brand value, lost customers, and possibly the loss of our business.  \n2. What approach should business leaders take to start an effective risk management program?  \nFirst and foremost, an organization needs to have strong support from executive leaders. Implementing a risk management program will involve personnel from throughout the organization, so it is important for executive leaders","cbCaijKS4owN5Xir","https://ap.wps.com/l/cbCaijKS4owN5Xir","pdf",42651,"English","# What are the personal risks for executives when security controls or data protection compliance fail?\n## Legal and regulatory drivers\n## Executive and organizational accountability\n# What approach should business leaders take to start effective risk management?\n## Executive sponsorship and organization-wide involvement\n## Building the right team\n## Using proven risk management frameworks","[{\"question\":\"What personal risks do business executives face if they fail to implement effective security controls or comply with data protection regulations?\",\"answer\":\"Executives can face substantial fines and penalties, and in some cases personal liability that may include jail time. Organizations may also suffer penalties, civil suits, reputational damage, and lost customers.\"},{\"question\":\"How should business leaders structure an information security program to meet legal and regulatory requirements?\",\"answer\":\"Security programs should be built based on risk assessments focused on safeguarding customer and personally identifiable information (PII), and on the systems where that data is processed and stored. Leaders should also align the program with applicable laws and regulatory guidance.\"},{\"question\":\"What is the recommended first step for starting an effective risk management program?\",\"answer\":\"Obtain strong support from executive leadership and communicate the importance of risk management to all personnel, ensuring organization-wide involvement. Visible executive sponsorship is presented as essential for program success.\"}]","Elevator Speeches for Business Leaders - Final Draft for November 2007 CSI Alert - Security and Compliance Risk Answers | PDF",1788550219,15]