Cyber risk continues to be a major concern for businesses of all kinds, including life science companies. Not only can such attacks cause reputational and brand damage, but they are also incredibly expensive.  

According to Cybersecurity Ventures, cybercrime is predicted to cost the world $9.5 trillion USD in 2024. Forbes has similar projections, expecting cybercrime costs to grow by 15 percent per year over the next two years to reach $10.5 trillion USD annually by 2025. A strong cybersecurity defense is critical to protecting your investors and customers from the damage a cyber-attack can cause.
 

This is especially important for life science companies. The high stakes work they conduct and the sensitive data they manage make life sciences companies a favorite target of cybercriminals, according to the Ransomware Task Force, a group of tech executives that makes recommendations to the White House. In the worst cases, ransomware incidents can affect patients.  

For example, an attack on a hospital in Düsseldorf, Germany, forced healthcare workers to send a patient with a life-threatening condition to another hospital 20 miles away. The patient later died. Investigators opened a negligent homicide case but abandoned it when they couldn’t prove the breach directly caused the death.  

The importance of cybersecurity governance for life science companies

If you’re a life science company planning to reassess your cybersecurity policies this year, governance will be critical to your success. Cybersecurity governance means that the board and management understand the cybersecurity program and are involved in decisions. With a robust cybersecurity governance process in place, an organization is better prepared to mitigate risks, address threats and meet regulatory and compliance responsibilities.  

There are three pillars of cybersecurity governance: What are you doing? Is it enough? And how do you know? Let’s examine the three pillars and their meanings.  

Download exclusive insights: A white paper on materiality and cybersecurity

The three pillars of cybersecurity governance

What are you doing? 

First, you should fully understand the cybersecurity program and governance model you currently have in place. That means you should: 

• Understand the data you’re collecting and how you’re collecting it  
• Understand what you’re doing to protect the data you collect 
• Understand who is responsible for monitoring your cybersecurity program 
• Ensure you are storing the minimum amount of data you need to run your organization  
• Understand regulatory compliance obligations 

Is it enough? 

Knowing if your cybersecurity plan is enough should involve a constant process of evaluating risk. If you determine that your residual risk is too high, you may need to make additional investments in security. 

 Questions to ask include: 

• Do you understand your risks? 
• Are you meeting compliance obligations? 
• Do you have controls in place to ensure only certain people have access to specific data and only certain people can modify that data? 
• Do you have redundancy, backup, recovery and resiliency plans in place?

How do you know? 

Knowing you are prepared is about having the right monitoring processes and understanding how you would react to various cybersecurity events. Ask yourself:  

• Do you have appropriate monitoring to detect a cyber breach should one occur, and has a third party validated that it functions as intended? 
• If an attack succeeds, do you have processes in place to help you recover? 

Start building a cybersecurity governance plan today  

BPM offers Cybersecurity Assessment Services, including penetration testing and incident assessment support. Our independent team evaluates your organization to identify your information security weaknesses and helps you understand where threat actors are most likely to strike. Then, we work with you to build a methodology to manage cybersecurity risk and develop risk-prioritized recommendations and controls so you can respond to and monitor an attack should the worst occur.  

It’s never a bad time to revisit your cybersecurity plan. Contact us today to ensure you are ready to handle whatever cybersecurity threat you might face tomorrow.  

Contact us today to get started.