Amendment 13 and the boardroom

An illustrative scenario, built from typical situations. It does not describe a specific client.

The situation

A mid-market Israeli company with a consumer app and an EU customer base renewed its cyber policy in the spring. The board had never discussed cyber risk as a separate agenda item; security was "handled by IT", and the insurance by the CFO and the broker.

Then Amendment 13 to the Privacy Protection Law came into force, with administrative fines and a wider basis for class actions. The general counsel asked a simple question at the next board meeting: if we are breached tomorrow, can we show that the board exercised oversight? Nobody could answer.

What we found

A privileged review, run through counsel, showed three gaps:

1. The proposal form overstated MFA. It declared MFA on all remote access, but two vendor accounts and a legacy remote-desktop server had none.
2. The DPO role was nominal. A DPO had been named, but had no access to the board and no documented reporting line.
3. No board record. There were no minutes showing that directors had asked about cyber exposure, coverage or the policy's conditions.

What changed

• The missing MFA paths were closed before mid-term, and the broker was briefed on what to tell the insurer.
• The DPO received a reporting line to the audit committee and a quarterly slot on its agenda.
• The board adopted a short cyber-oversight calendar, and its minutes now record the questions asked and the answers received.
• The cyber and D&O policies were read side by side, to make sure a regulatory claim against a director would not fall between them.

The lesson

Amendment 13 did not create a new duty for directors to become security experts. It made it far more costly for a board to be unable to show that it asked. The evidence of oversight has to exist before the incident, not be reconstructed after it.

This case study is general information, not legal advice.