Assessing how much a company is legally obligated to invest in cyber security remains a challenge. Since there is no such thing as perfect security (i.e., there is always more that you can do), resolving these questions can significantly affect cost.

a. When are a company’s security measures sufficient to comply with its obligations? For example, does installing a firewall and using virus detection software satisfy a company’s legal obligations?

b. Is it necessary for an organization to encrypt all of its electronic records?