Don’t Make It Easy for Them Through Gaps in Technology Oversight

Don’t Make It Easy for Them Through Gaps in Technology Oversight

Public entities are adopting technology to improve efficiency while managing increasingly connected risks. Artificial intelligence (AI), third-party services, and digital systems can introduce exposures that extend beyond the technology itself.

When departments adopt AI independently, inconsistent practices and unclear accountability can follow. Without centralized oversight, public entities may struggle to manage how these tools are used across their operations.

Public entities can start by examining the governance gaps that can leave information and operations exposed.

“Cybersecurity needs to be part of how employees perform their everyday responsibilities,” said Betty Coulter, Senior Risk Control Manager at Safety National. “Clear procedures and an easy way to report concerns help turn awareness into action.”

Establish Clear Rules for Data and AI

Third-party AI tools can introduce privacy and confidentiality risks when sensitive information is mishandled or improperly shared. Public entities can help manage these exposures through centralized governance, formal procurement and deployment policies, defined responsibilities, and staff training on responsible use and data privacy.

Vendor transparency about information use and storage, along with appropriate ongoing assessments or audit rights, can further support oversight.

Understand Dependence on Vendors

Cyber exposure also includes the organizations a public entity relies on. Dependence on a single critical provider is a potential single point of failure, a concern that applies across industries.

A disruption at that provider can affect the organization depending on it. These relationships are therefore important considerations for both risk management and cyber underwriting.

“As organizations become more reliant on outsourced service providers, their individual security may improve, but aggregation risk to the global economy and insurance industry also increases,” says Spencer Timmel, Head of Cyber Insurance at Safety National. “Consider the number of businesses using a relatively small number of global technology and cloud providers. A single vulnerability within those offerings could expose a significant number of companies to a cyber event.”

Connect Policies with Practice

Written expectations need consistent implementation. Updated policies and procedures should be supported by comprehensive risk control programs that require adherence. That principle supports a coordinated approach to managing technology exposures.

Public entities face cybersecurity challenges shaped by their resources, systems, and outside relationships. Making those responsibilities clear can help them address the gaps that leave risk unmanaged.

“Don’t Make It Easy for Them” means bringing oversight and accountability into the decisions that determine how technology is adopted and used.

This material is provided for general informational purposes only and is not intended as legal advice.

Public entities are adopting technology to improve efficiency while managing increasingly connected risks. Artificial intelligence (AI), third-party services, and digital systems can introduce exposures that extend beyond the technology itself.

When departments adopt AI independently, inconsistent practices and unclear accountability can follow. Without centralized oversight, public entities may struggle to manage how these tools are used across their operations.

Public entities can start by examining the governance gaps that can leave information and operations exposed.

“Cybersecurity needs to be part of how employees perform their everyday responsibilities,” said Betty Coulter, Senior Risk Control Manager at Safety National. “Clear procedures and an easy way to report concerns help turn awareness into action.”

Establish Clear Rules for Data and AI

Third-party AI tools can introduce privacy and confidentiality risks when sensitive information is mishandled or improperly shared. Public entities can help manage these exposures through centralized governance, formal procurement and deployment policies, defined responsibilities, and staff training on responsible use and data privacy.

Vendor transparency about information use and storage, along with appropriate ongoing assessments or audit rights, can further support oversight.

Understand Dependence on Vendors

Cyber exposure also includes the organizations a public entity relies on. Dependence on a single critical provider is a potential single point of failure, a concern that applies across industries.

A disruption at that provider can affect the organization depending on it. These relationships are therefore important considerations for both risk management and cyber underwriting.

“As organizations become more reliant on outsourced service providers, their individual security may improve, but aggregation risk to the global economy and insurance industry also increases,” says Spencer Timmel, Head of Cyber Insurance at Safety National. “Consider the number of businesses using a relatively small number of global technology and cloud providers. A single vulnerability within those offerings could expose a significant number of companies to a cyber event.”

Connect Policies with Practice

Written expectations need consistent implementation. Updated policies and procedures should be supported by comprehensive risk control programs that require adherence. That principle supports a coordinated approach to managing technology exposures.

Public entities face cybersecurity challenges shaped by their resources, systems, and outside relationships. Making those responsibilities clear can help them address the gaps that leave risk unmanaged.

“Don’t Make It Easy for Them” means bringing oversight and accountability into the decisions that determine how technology is adopted and used.

This material is provided for general informational purposes only and is not intended as legal advice.