A breach caused by lack of security management resulted in a civil lawsuit.

In the event of a civil lawsuit resulting from inadequate security management, the organization must communicate with the board of directors. Managing Cloud guidance explains that the board of directors holds ultimate responsibility for governance, oversight, and risk management within an organization.

The board ensures that appropriate policies, controls, and management structures are in place to protect organizational assets and comply with legal obligations. In legal matters, the board must be informed to oversee response strategies, legal counsel engagement, and corrective actions.

The IT department manages technical controls but does not provide organizational oversight. High-level government agencies are regulators, not internal oversight bodies. Therefore, board members are the correct entity to contact.