Board Briefing – Round One “You are up to the plate” Law Essay

Board Briefing – Round One – Annual Meeting 2020 – Operation: “You are up to the plate”
You were newly hired as Chief Information Security Officer (CISO) for the XYZ Bank, a nationally
chartered, FFIEC regulated full service bank. XYZ Bank also is publicly traded on the NY Stock Exchange.
The bank is incorporated in New York under its banking laws, and does business in nearly every state in
the United States. It has a presence in the UK (London) but only a very limited presence in other EU
states. Your computer infrastructure is relatively new, yet you have a lot of businesses and subsidiaries
in the bank that primarily use the cloud.
It is January 2020. You were just hired in September 2019 from another bank (albeit smaller and
regional in presence). Before that, you worked as No. 3 at Fed Ex in the IT department and were
involved in all kinds of business interruption issues. In your current position, you have a relatively
experienced team of 20 people, and a cyber security capital budget of $1 million dollars (including
salaries, which can be frighteningly high). Your employer did a major acquisition in 2017 and is still
having growing pains assimilating the new business.
You just had a vulnerability assessment done. It was relatively good, but the bank has never been able to
catch up to all the operating system and network patching that is required on a weekly basis. You are
always behind. You know about NotPetya cyber attack from your last job.
Your CEO walks up to you and asks you to make your first address to the Board of Directors. The CEO
tells you that the board members, who come mostly from other regional and national banks, are not
cyber savvy. They do not speak tech, and have gotten frustrated in the past with other CISO’s being too
tech and cyber savvy. The CEO gives you one last piece of advice: keep it to a half hour or they will get
bored.
In preparation for the board meeting, please draft a 3 page memo to the CEO, addressing the following
issues:
1. Please identify 3 cyber security issues that may have legal implications, and describe the
relevant legal implications.
(No more than 1 page)
2. Please provide the arguments you will make to the board for why it makes sense to have robust
up to date cybersecurity policies and procedures. In discussing this, please:
a. Summarize three cyber attacks that would be relevant to XYZ Bank: vulnerabilities that
were exploited; penalties (criminal or civil), any other tangible or intangible losses, and
anything else you believe to be relevant.
b. Point out to Directors their exposures and liabilities if they fail to use reasonable care
and diligence in creating and overseeing cybersecurity policies and procedures.
(No more than 2 pages)

Financial Privacy & Cybersecurity Midterm Assignment Board Briefing – Round One – Annual Meeting 2020 – Operation: “You are up to the plate” You were newly hired as Chief Information Security Officer (CISO) for the XYZ Bank, a nationally chartered, FFIEC regulated full service bank. XYZ Bank also is publicly traded on the NY Stock Exchange. The bank is incorporated in New York under its banking laws, and does business in nearly every state in the United States. It has a presence in the UK (London) but only a very limited presence in other EU states. Your computer infrastructure is relatively new, yet you have a lot of businesses and subsidiaries in the bank that primarily use the cloud. It is January 2020. You were just hired in September 2019 from another bank (albeit smaller and regional in presence). Before that, you worked as No. 3 at Fed Ex in the IT department and were involved in all kinds of business interruption issues. In your current position, you have a relatively experienced team of 20 people, and a cyber security capital budget of $1 million dollars (including salaries, which can be frighteningly high). Your employer did a major acquisition in 2017 and is still having growing pains assimilating the new business. You just had a vulnerability assessment done. It was relatively good, but the bank has never been able to catch up to all the operating system and network patching that is required on a weekly basis. You are always behind. You know about NotPetya cyber attack from your last job. Your CEO walks up to you and asks you to make your first address to the Board of Directors. The CEO tells you that the board members, who come mostly from other regional and national banks, are not cyber savvy. They do not speak tech, and have gotten frustrated in the past with other CISO’s being too tech and cyber savvy. The CEO gives you one last piece of advice: keep it to a half hour or they will get bored. In preparation for the board meeting, please draft a 3 page memo to the CEO, addressing the following issues: 1. Please identify 3 cyber security issues that may have legal implications, and describe the relevant legal implications. (No more than 1 page) 2. Please provide the arguments you will make to the board for why it makes sense to have robust up to date cybersecurity policies and procedures. In discussing this, please: a. Summarize three cyber attacks that would be relevant to XYZ Bank: vulnerabilities that were exploited; penalties (criminal or civil), any other tangible or intangible losses, and anything else you believe to be relevant. b. Point out to Directors their exposures and liabilities if they fail to use reasonable care and diligence in creating and overseeing cybersecurity policies and procedures. (No more than 2 pages)