Titled “The Financial Management of Cyber Risk: An Implementation Framework for CFOs“, the document is literally a “how to” guide to understanding and addressing the finanical implications of cyber risk.

Melissa Hathaway, President of Hathaway Global Strategies and fomer Acting Senior Director for Cyberspace for the National Security Council notes that this is “an excellent guide for organizations to manage the risk and exposure derived from digital dependence.”

This paper is must reading for the CFO of any organization that has exposure to data breach risks. It is especially valuable to healthcare financial executives because of the enhanced regulatory environment in healthcare due to the recently passed Health Information Technology for Economic and Clinical Health (HITECH) Act. But CFOs in all industries and organizations that are entrusted with sensitive personally identifiable information (PII) and protected health information (PHI) should make the time to read this.

The context and perspective of this paper is best summarized in the executive summary where it states:

“Most enterprises today categorize information security as a technical or operational issue to be handled by the information technology (IT) department. This misunderstanding is fed by outdated corporate structures wherein the various silos within organizations do not feel responsible to secure their own data….In reality, cybersecurity is an enterprise-wide risk management issue that needs to be addresssed from a strategic, cross-departmental, and economic perspective. The CFO as opposed to the CIO or CSO, is the most logical person to lead this effort.”

If one were to ask the CFO at a Fortune 500 company to quantify their level of risk to cybercrime and associated risks of data breach, most would have a difficult time answering the question. Financial officers tend to defer the management of data breach risks to the information security team. Unfortunately, this leaves many organizations exposed to risks that are misunderstood, unquantified, and uncovered.

If you are the CFO of an organization of any size and in any industry — healthcare, financial services, manufacturing, retail — or in the public sector or higher education, don’t wait to read this document.

These include:

- Customer/patient/client churn rate, the tendency for a data breach event to cause them to “vote with their feet” and choose another provider, remains the key cost driver for data breach incidents. Such lost customer costs are typically 2/3rds the cost of a data breach. Industries that exhibit the highest churn rates are healthcare, pharmaceuticals and communications (all 6%).

- Almost half (44%) of organizations outsourced the data breach response effort to an expert third party consultant. When outsourced in this way, the costs per victim declined a huge 26% vs. companies that “go it alone”. The ability to reduce costs by outsourcing the response process is counterintuitive to some, but validates the value of an outside consultant that is knowledgeable and can execute using best practices

-  “Companies that notify too quickly may incur higher costs”. This was surprising to me. The study found that these “quick responders”, organizations that notified within one month of detection of the breach, ended up paying 12% more than their peers. The assumption was that moving too quickly through the process causes inefficiencies that can be avoided.

As always, the study and report is full of valuable and interesting data and perspective for privacy, information security,  legal and financial officers. It is a “must read” for anyone in a relevant role at an organization that is entrusted with PII and PHI, especially the CISOs who are most frequently the organizational members responsible for the handling of data breach incidents.

Since the SSA’s founding in 1936, its numbering system has been relied upon as the identifier for such items as drivers’ licenses, employee records, bank and credit accounts and, as in the issue at hand, health records. However, in quite the impasse, most Americans are not legally required to give their SSNs in order to receive services, albeit there is no law prohibiting companies from requesting it and denying services unless it is provided.

In May, the inspector general for the Social Security Administration released a report urging Medicare to stop using Social Security numbers, especially on wallet-sized cards patients receive and are told to carry. Additionally, last year, the Office of Management and Budget sent a memo ordering federal agencies to stop the unnecessary use of Social Security numbers as identification.

Also, federal legislation is pending in the form of H.R. 3046 (Social Security Number Privacy and Identity Theft Prevention Act of 2007) which would limit the use of SSN as an identifier by government and business, and as recently as this summer New Hampshire congressman Paul Hodes introduced the Medicare Card Security Act (H.R. 6399) to protect seniors by amending the Social Security Act in this manner.

While this potentially dangerous nine digit sequence is still widely in use, actions are in effect at citizen and government levels to protect us from giving a free pass to identity thieves. We may still be at risk, but protection of our SSN by not carrying, displaying or providing it verbally unless absolutely required to do so should be at the heart of our defensive efforts.