Cordium, providers of GRC services, has questioned how knowledgeable equity firms are about the cyber risks within companies in their portfolios.
According to Cordium, cyber breaches and data security violations, can have a very real impact on the value of a corporate holding.
Cordium used the search engine Yahoo as an example, as the search engine was forced to reduce the sales price of its email and digital services to Verizon Communications as a result of two large cyber breaches in 2013 and 2014.
Cordium said: “Since the breach, dozens of lawsuits have been filed, and Yahoo is under investigation by regulators. The company recently announced that up to three billion people could have had their personal information compromised. Cyber risk—and organisations’ exposure to it—is increasing.”
Cordium stated that to protect revenue and preserve the value of their investment portfolio, “it makes sense for private equity firms to ensure that the companies they have stakes in are not only compliant with industry rules, but are also applying good practices to properly manage the cyber risks and data protection threats they face”.
The business consultant said the US federal government has a large cybersecurity programme that “will, very quickly, translate into new rules and practices across industries”, while the General Data Protection Regulation (GDPR), which comes into force in May 2018, has “extraterritorial impacts for firms that engage with EU-based clients”.
It said the EU is also starting a range of cyber risk initiatives that will also translate into new rules.
Cordium concluded: “Private equity firms need to ensure they have the capabilities to fully assess and manage cyber risks within their portfolio companies—to be able to do this could make the difference between a successful investment and one which suffers in value because of reputational risk, legal risk, and regulatory sanctions.”
