From compliance to security, responsibility beyond law

Computer law & security review, vol. 52, pp. 105926

Abstract

In this opinion piece, I advocate for the adoption of a care-based stakeholder approach in cybersecurity for companies. With the ever-increasing digitization of all aspects of life, companies are struggling to keep themselves and their customers secure. This is, at least in part, due to their focus on compliance to standards and regulations, they fall victim to a checkbox-mentality where compliance instead of security is seen as the goal. This strong focus on compliance creates security blind-spots and the negative impact it has on security is strengthened by the “pacing problem” – where technology evolves faster than the law. Thus, leaving a gap where there is a lack of legislation and enforcement for new technologies. In this opinion piece I argue that the responsibility for cybersecurity should be shared by governments and companies. To give companies the tools they need for ethical decision-making and thus truly take responsibility, I suggest combining the ethics of care with stakeholder theory to provide a context-based relational view of companies. With this caring stakeholder model, companies have the tools they need to transition from compliance to security.

Authors 1

1. Jasmijn Boeken corresponding Aachen Institute of Security and Global Affairs

   Leiden University · The Hague University of Applied Sciences

   Affiliation as printed

   Centre of Expertise Cyber Security, The Hague University of Applied Sciences, Johanna Westerdijkplein 75, The Hague 2521 EN, the Netherlands

   Institute of Security and Global Affairs (ISGA), Leiden University, Turfmarkt 99, The Hague 2511 DP, the Netherlands