IT system reliability is a top priority
Didactum® analyzes the responsibility of company management with regard to IT system security
Most companies focus their efforts to prevent failures of servers, routers, and other essential hardware for maintaining the IT system solely on the technical level of system administrators, who, in the event of a failure, only have to worry about the security of their own workplace.
Legal consequences of a failure for company management
However, the consequences of a failure for company management are far more extensive on a legal level.
The greatest risks for company management arise from the legal consequences of a system failure. Management is typically aware of the contractual obligations that can no longer be fulfilled towards customers and business partners when technical availability of the IT system is not maintained within the narrow contractual limits. This results in revenue losses and contractual penalties.
This merely covers the financial aspect of responsibility, which the company management is held accountable for.
Criminal law consequences of IT system failures
The criminal consequences of a failure are not only more serious but also affect the company’s legal representatives personally.
Potential violations of law resulting from an uncontrolled outage include, among others, breaches of data protection regulations, failure to comply with statutory disclosure obligations under corporate law applicable to the company’s legal form, or violations of cooperation obligations under tax and commercial law.
Liability for these violations is measured against the standards of objective avoidability and foreseeability based on the current state of technology.
If the technical means for optimal protection of the IT system are not used due to financial restrictions or organizational deficiencies, this determines the fault standard for the company’s legal representatives, with the criminal consequences described above.
Such responsibility cannot be delegated!
IT systems checklist
IT system security begins with audit-proof data integrity, includes verification of the licenses for the system software in use, and does not end with the electrical supply to the hardware.
Fire protection and securing premises against unauthorized external access must also appear on the company management’s checklist.
If, in these areas, unauthorized access to the system is not prevented, technical measures to avoid failures caused by water or fire damage are not implemented, and compliance with technical possibilities for safeguarding system integrity is not adequately documented, the management bears personal responsibility for the resulting consequences.
Subsequent exculpation without adequate documentation of incidents is virtually impossible.
Take your IT security into your own hands!