Global Businesses Witness a 23% Surge in Chief Legal Officers Focusing on Cybersecurity Since 2020
In a significant shift, Chief Legal Officers (CLOs) are increasingly assuming key roles in cybersecurity governance, risk management, and communication, according to a new report by the Association of Corporate Counsel (ACC) Foundation.
The report, "The 2025 State of Cybersecurity Report: An In-house Perspective," reveals that globally, CLOs are taking on leadership positions in cybersecurity strategy and frequently communicating these strategies to company boards. The data is based on a survey of 278 in-house legal professionals from across 16 countries and 20 industries.
The ACC Foundation attributes this change to an acknowledgment of the growing legal and governance aspects of cybersecurity, making CLOs essential for managing operational risks, incident response, liability, reputation management, and business continuity.
Veta T. Richardson, President of the ACC Foundation and President & CEO of ACC, expressed, "Cybersecurity threats pose substantial, organization-wide risks with significant reputational, operational, legal, and financial implications. The ACC Foundation's 2025 State of Cybersecurity Report demonstrates the swift expansion of CLOs and their teams, becoming involved in leading and navigating complex cybersecurity landscapes."
Key findings from the survey include:
- Half of CLOs report collaborating with cybersecurity teams, even without specific leadership positions.
- An overwhelming majority (93%) of organizations involve the legal department in their incident response teams, with the CLO being a member in 73% of cases.
- The number of CLOs in leadership roles related to cybersecurity responsibilities has increased from 15% in 2020 to 38%.
- One-third of organizations now employ a dedicated cyber lawyer, up from 18% in 2020.
- CLOs are primarily concerned about phishing, social engineering, data breaches, ransomware, fraud, and lack of awareness as AI-powered cyber threats.
Jennifer Chen, Executive Director of the ACC Foundation, stated, "The ACC Foundation's Cybersecurity Report serves as a call to action for in-house counsel to embrace their expanding role, develop cybersecurity expertise, and proactively address the legal and regulatory challenges presented by this ever-evolving threat landscape. By taking a leadership role in cybersecurity, in-house counsel can protect their organizations from significant financial, reputational, and legal harm, ensuring business continuity and building a more resilient future."
The report also highlights that a large majority (95%) of organizations now require mandatory cybersecurity training, up from 62% in 2018. Other key highlights include a more active involvement of legal departments in third-party risk management and an increase in the evaluation of vendors for cyber risk.
Reputational damage, liability and litigation, and business continuity threats remain the top concerns for CLOs dealing with cybersecurity issues.
The report is available for download here.
The ACC Foundation is a non-profit organization dedicated to supporting in-house legal professionals through education, research, pro bono service, leadership development, and initiatives fostering inclusiveness. The Foundation collaborates with various entities to achieve these goals.
The Association of Corporate Counsel (ACC) serves the needs of in-house counsel globally by providing information, education, networking, and advocacy opportunities, having established a standard for in-house counsel in the C-suite and boardroom for over four decades. With over 48,000 members from more than 10,000 organizations across 100+ countries, ACC facilitates the personal and professional growth of in-house counsel. For more information, visit www.acc.com and follow ACC on LinkedIn, X, Facebook, and Instagram.
The ACC Foundation's report reveals that CLOs are collaborating with cybersecurity teams to lead and navigate complex cybersecurity landscapes, highlighting the increasing importance of finance as these strategies often involve managing operational risks, incident response, and business continuity. The report also discusses the rise of dedicated cyber lawyers in businesses, signifying the integration of technology and cybersecurity within business operations.
