Top Cybersecurity Myths: Cybersecurity Is Not My Problem 

When it comes to cybersecurity, a number of myths persist among small businesses and nonprofit organizations. These blind spots can put your organization at higher risk. Our Top Cybersecurity Myths article series looks at myths we hear frequently, why they are not true, and how they can actually put your organization at higher risk. 

MYTH: Cybersecurity is an IT problem. It’s not my problem. 

If we asked you who is responsible for information security at your organization, who would you say? Would you say the IT manager? The entire IT department? An information security officer? 

Many organizations share this sentiment—that the responsibility for cybersecurity is held by a few people. But let’s explore this misconception and why cybersecurity is actually the responsibility of every individual at an organization. 

Cybersecurity is a business risk. 

Cybersecurity is not just an IT risk. If an incident occurs, an organization may experience fines, penalties, and legal fees. Organizations can also experience reputation damage as clients, donors, and other constituents lose faith in the organization’s ability to protect their sensitive information and donations. 

These types of threats are damaging to the organization as a whole, not just the IT department. Organizations often struggle to recover from the short-term and long-term financial impact of a breach. And that affects all employees, not just the IT staff. 

Response to breaches includes more than just the IT department. 

When a breach occurs, IT staff are undoubtedly involved. However, appropriate breach response does not just include technical employees. Your public relations and marketing staff should be involved to ensure your constituents and the media are updated appropriately. Legal counsel generally must be consulted to ensure all applicable laws and regulations are considered. Human resources, security, operations personnel, and other levels of management may also get involved, depending on the type of incident. 

An end user can prove to be the weak link. 

Good employees make mistakes all the time. Even if your technical department puts every possible control in place, there will always be that one staff member who is in a rush, improperly trained, or just makes a mistake. These people will click on a phishing link that installs malware or will improperly authenticate a request and give out sensitive data. 

Cybersecurity is the responsibility of your entire user base, and this responsibility needs to be communicated, starting from the top down. 

What next? 

As you can see, cybersecurity affects the entire organization. It’s not the responsibility of just one person. Therefore, it’s imperative to take the following steps: 

• Develop a culture of security that starts at the top level of your organization. Staff must see their management taking responsibility for cybersecurity. This can be established by having standing IT/information security department updates at board meetings. 

• Establish a cybersecurity training program to ensure staff members understand the threats that are out there and what they can do to help keep your organization secure. 

• Implement authentication requirements, requiring longer, more complex passwords for critical IT systems and multi-factor authentication for critical and high-risk systems. 

• Develop an incident response plan that includes input from applicable departments. Conduct tabletop testing (a discussion-based exercise in responding to a hypothetical incident) where these individuals discuss various scenarios and how the plan would be enacted. 

Are you ready to make cybersecurity a priority for your entire organization? Contact your CRI advisor for help.