FIIG is useful because the Court was careful about what the law requires. A successful cyberattack does not automatically prove a business broke the law. But where a regulated business holds highly sensitive client information, the question becomes whether its cyber controls, staffing, funding, incident response and risk management were adequate for the risk.
The agreed facts pointed to practical failures: no adequate incident response plan for much of the period, gaps in multi-factor authentication, penetration testing, patching, privileged access controls, monitoring, training and review of cyber resilience. FIIG also admitted that adequate controls would have helped it detect and respond to the breach sooner and could have prevented some or all of the data from being downloaded.
For small and scaling businesses, the lesson is to stop treating cyber as a vague IT spend. If you collect client identity data, payment data, investment records, health data or tax file numbers, you need clear ownership, budget, controls, testing and board-level reporting.