Could your organization make the right decisions in the first hour of a breach?
A cybersecurity incident can become a leadership problem within hours. Mission 45 programs help New Mexico owners and executives ask the right questions before the 45-day clock starts.
The first test of executive due diligence is the ability to comply with New Mexico's 2017 Breach Notification Act. Do you know what that law requires of your organization?
An Executive Guide to Data Breach Readiness in New Mexico
Three Numbers to Remember
1
Person
45
Calendar Days
1,000+
Residents
TOMORROW MORNING · 8:03 AM
Imagine learning that an employee's email account was compromised overnight.
The mailbox contains customer information.
Technology may be compromised, but leadership now faces decisions involving customers, operations, attorneys, insurers, employees, vendors, finances, communications, and New Mexico law.
SELF-RECOGNITION
Take the First-Hour Test
Could leadership quickly answer these six questions?
If several answers are “I don't know,” “I'm not sure,” or “I assume someone handles that,” you have identified an executive due diligence gap - before a crisis forced that discovery.
THE LEADERSHIP CONSEQUENCE
The 45-Day Clock is not preparation time.
Not every incident requires notification. But while that determination is being made, someone may need to establish what happened, what information was involved, which customers were affected, and what legal and insurance obligations apply.
Who has responsibility and authority for those decisions?
MORE THAN NOTIFICATION
Leadership needs visibility before the numbers matter.
Could leadership answer these six questions?
These questions do not require executives to become cybersecurity technicians. They require executives to exercise due diligence.
MORE THAN NOTIFICATION
Use the Executive SAVE Test
SecureNM™ provides a simple framework for approaching leadership's continuing responsibility.
SEE the Risk
Understand what needs protection, what could materially disrupt the organization, what obligations may apply, and where specialized expertise may be required.
ASSIGN Accountability
Know who is responsible for cybersecurity operations, insurance, legal questions, communications, vendors, and other important functions.
VALIDATE Safeguards
Assumption is not validation. Leadership needs a reasonable way to determine whether the practices it believes exist actually do.
ENSURE Action
Identifying a problem is not the same as resolving it. Important issues need to be followed through to appropriate action.
SecureNM™ Mission 45 examines the 2017 New Mexico Breach Notification Act to demonstrate Executive Due Diligence as it applies to business and non profit leaders. Request a presentation.
CLARIFY THE RESPONSIBILITY
Due diligence is not due care.
Executives exercise due diligence in cybersecurity in much the same manner that they manage every other aspect of their organizations. Due care is the implementation of the organization's needs as determined by best business practices. This distinction is fundamental to Mission 45 and SecureNM™.
Executive due diligence
Leadership's responsibility to understand risk, establish accountability, ask informed questions, validate readiness, make decisions, and ensure appropriate action.
Professional due care
The work required to protect the organization: implementing safeguards, configuring systems, providing legal advice, managing insurance, investigating incidents, and restoring operations.
For smaller organizations, the same owner or executive may participate in both. The distinction is the responsibility being performed - not necessarily the person performing it. Join Us and be prepared for breaches as well as new business opportunities.
THE PRACTICAL NEXT STEP
Ask 45 questions before the clock starts.
The Executive Due Diligence Assessment™ helps leaders examine governance, information and data, people and access, technology, third parties, incident readiness, business resilience, legal and insurance responsibilities, and executive verification.
Yes
Unsure
No
“Unsure” matters.
It identifies something leadership should investigate rather than assume.
Executive Due Diligence Assessment™
Asks whether leadership is appropriately engaged. It does not certify cybersecurity compliance or prescribe technical solutions. It identifies where leaders have sufficient visibility—and where additional questions, professional expertise, assessment, or action may be needed.
• Governance • Information
• People & Access • Technology
• Third Parties • Incident Readiness
• Resilience • Legal
• Insurance Verification
Go deeper when necessary
The comprehensive Cyber-safe Self-assessment™ helps examine what is actually happening throughout the organization.
Employees, internal personnel, and providers can examine actual practices. Where implementation or specialized expertise is required, appropriate professionals provide the due care.
SecureNM™ provides the structure for executives to keep asking the questions.
SECURITY LEADERSHIP IS ONGOING
Start Leaving Level 0
Level 0 is not defined by organization size, cybersecurity budget, or technical sophistication.
An organization can have excellent technology and still operate at Level 0 when leadership lacks visibility, is disengaged, or assumes someone else has everything covered.
A small organization with limited resources can begin leaving Level 0 immediately.
Cyber readiness is not a destination reached by completing one assessment. Executive due diligence is a continuing leadership responsibility.
Take The First Step Free
Become a better-informed leader of a cyber-ready organization.
SecureNM™ Community Membership is free. Community Members can access the downloadable 45-question Executive Due Diligence Assessment™, the comprehensive Cyber-safe Self-assessment™, online self-assessment workshops, member surveys, and member event opportunities.
Bring Mission 45 to your organization or event.
Informative presentations focused on practical executive breach readiness.