The roll call of well-known UK (and global) firms suffering a data breach grows on an almost weekly basis. The impact of a breach can range from disruption of services to far more serious reputational damage, loss of business and financial implications.
In a 2017 Ponemon study, commissioned by Centrify, the majority of chief marketing officers (CMOs) in the UK admit that the biggest cost of a security incident is loss of brand value. A data breach is potentially more damaging to a company’s reputation than more ‘traditional’ PR disasters like a product recall, an environmental incident or even a scandal involving the CEO.
So while the prospect of a serious data breach is keeping senior marketers awake at night, there seems to be something of a disconnect between the priorities of the IT department and the marketing teams. CMOs and CISOs are not talking to each other enough about the issues – at a time when brand value has never been more important.
The Ponemon study shows that there is little agreement between IT and marketing about who is responsible and how to respond. Seventy-one per cent of IT practitioners don’t see brand protection as their responsibility, despite 43 per cent admitting a cybersecurity incident or data breach would harm the brand value of the company. Yet, more than two-thirds (65 per cent) of senior marketers believe the IT department should take responsibility.
The marketing department also allocates more of its budget to brand protection; with 42 per cent of saying a portion of their marketing communications budget is allocated to brand preservation, and 60 per cent saying that their department collaborates with other functions in maintaining brand value. This compares to less than one in five IT practitioners allocating a portion of their IT security budget to brand preservation – and just 18 per cent collaborating with other departments.
Clearly marketing and IT are working in silos, failing to communicate properly and agree a way forward when it comes to the bigger picture – protecting customer data and brand reputation through better security.
Admittedly, more geeky individuals who tend to lack those wider communication skills have run IT in the past, but marketing is known for being represented by good communicators and more outgoing people, so the challenge is in telling the data security story in a language that everybody will understand and agree on.
One thing that both functions agree on, however is that brand protection is not taken seriously enough by senior-level executives within the business – a criticism that is often raised about the C-suite and security. More worrying perhaps is that 70 per cent of IT professionals do not believe their companies have a high level of ability to prevent breaches, although most CMOs (58 per cent) are confident in their company’s resilience to weather a breach.
With the General Data Protection Regulation (GDPR) less than a year away, the storage and security of customer’s information is top of mind right now for anyone holding data on individuals residing in Europe. If IT professionals and marketers are not aware of their obligations as a business under this regulation, then they need to be.
Certainly from the research Ponemon conducted, we found customers’ expectations for the security of the personal information they share with companies was higher than the CMOs and IT professionals’ sense of responsibility. More than three-quarters of UK consumers (79 per cent) believe organisations have an obligation to take reasonable steps to secure their personal information, however just 64 per cent of CMOs and 66 per cent of IT practitioners agree.
This gap between consumers’ expectations and the perceptions of IT and CMOs about how personal data should be safeguarded doesn’t end there. Less than half of CMOs and IT practitioners believe their company has a responsibility to control access to consumers’ information. Yet, 73 per cent of consumers believe they do have an obligation to control access.
Given that brand, reputation and customer loyalty (and loss) are so closely interconnected, it is surprising – and concerning – that those people perceived to be responsible for protecting a customer’s personal information do not accept and admit those responsibilities.
To increase confidence, companies need a strong security posture that includes an effective data breach response plan. But to start with, these organisations need to close the gap between different functions within the business, encourage teams to talk to each other, while ensuring the Board is actively engaged in order to be prepared for the eventual security breach. It’s a case of when, not if.
Source: Ponemon research study (2017) – The Impact of Data Breaches on Reputation & Share Value: A Study of Marketers, IT Practitioners and Consumers in the UK.
Contributor
Bill Mann, senior vice president of products and chief product officer, Centrify
