Fail-safety / Legal
IT System Reliability is a Leadership Responsibility - The Responsibility of Company Management for IT System Security
Most companies focus their efforts to prevent failures of servers, routers, and other necessary hardware for maintaining their IT systems solely at the technical level of system administrators, who, in the event of a failure, only need to consider the security of their own workstation.
Consequences for Company Management
The consequences resulting from a failure are, however, much more far-reaching for company management on a legal level. The greatest risks for executives arise from the legal consequences of an outage.
Typically, the executive level knows the contractual obligations that can no longer be fulfilled towards customers and business partners if technical availability of the IT system is not provided within the tight contractual boundaries. This results in financial losses and contractual penalties. However, this pertains only to the financial aspect of responsibility that company management must bear.
Criminal Consequences
The criminal consequences of a failure are not only more severe, but also affect the company's legal representatives personally.
Threatened offenses resulting from an uncontrollable outage include, among others, violations of data protection laws, non-compliance with statutory disclosure obligations under the corporate law of the respective company form, or breach of cooperation obligations in tax and commercial law.
Responsibility for these violations is determined according to the standards of objective avoidability and foreseeability, applying the current state of the art.
If, for financial reasons or organizational deficiencies, the technical possibilities for optimal IT system protection are not utilized, this results in the culpability criteria for company legal representatives with the described criminal consequences. This responsibility cannot be delegated.
Checklist
IT system security starts with audit-proof data integrity, continues through the license review of the system software used, and does not end with the electrical supply of the hardware.
Fire protection and securing premises against unauthorized external access must also appear on the management's checklist.
If unauthorized access to the IT system is not prevented, technical options for preventing outages due to water or fire damage are not used, and the adherence to technical possibilities for securing system integrity has not been sufficiently documented, the company management is personally responsible for the resulting consequences.
Subsequent exculpation is almost impossible without sufficient documentation of incidents.