White paper · October 29, 2026 · 11 pages
Cybersecurity
Across Borders
Best practices for international business leaders
A practical framework for protecting critical services, managing cross-border dependencies, and coordinating executive decisions when a cyber event spans jurisdictions.
Executive summary
One incident can become a global operating problem.
International businesses rely on digital services that connect employees, customers, suppliers, and facilities across national borders. Those connections support growth, but they can also carry disruption from one location to another.
A single event may interrupt operations, expose personal information, affect partners, and trigger several reporting obligations with different thresholds and timelines. The paper recommends combining enterprise accountability and a common security baseline with local expertise and jurisdiction-specific requirements.
The objective is not simply to prevent incidents. It is to maintain essential services and make timely, defensible decisions when information is incomplete.
Maersk's estimated losses from NotPetya in 2017, after malware entered through tax-filing software used in a single country. The example shows how one local dependency can affect a global enterprise and its customers.
Eight practices at a glance
A coordinated operating model for international resilience.
Leadership sets the risk tolerance and decision rights. Central teams establish the baseline. Regional leaders apply it locally. Service and supplier owners keep essential operations working.
- 01Establish accountability and decision rights
Define who owns cyber risk, critical services, exceptions, notification, communications, and restoration.
- 02Identify critical services and dependencies
Map the people, applications, equipment, facilities, information, suppliers, and countries each service depends on.
- 03Maintain a jurisdiction and obligations register
Connect entities and services to the laws, regulators, contracts, thresholds, deadlines, and reporting channels that apply.
- 04Apply and verify a global security baseline
Require proportionate controls across the enterprise, document exceptions, and test recovery against business objectives.
- 05Manage suppliers by business impact
Assess access, information sensitivity, failure consequences, subcontractors, continuity evidence, and exit requirements.
- 06Govern international data flows
Know where sensitive information is stored, accessed, processed, backed up, and shared—and which rules govern each flow.
- 07Prepare people and rehearse response
Maintain cross-time-zone contacts, alternate communications, escalation paths, and scenarios that involve multiple countries.
- 08Measure outcomes and improve
Track whether essential services can recover, supplier risks are current, exceptions are resolved, and exercise actions are completed.
For the next board or executive meeting
Six questions leaders should be able to answer.
The answers reveal whether resilience is grounded in verified business operations or only in policy and technical reporting.
- Q1
Which services would cause the greatest harm if unavailable, and have we tested their recovery?
- Q2
Where do multiple services rely on one provider, identity system, location, or communications route?
- Q3
Can we identify affected entities, jurisdictions, customers, and data quickly during an incident?
- Q4
Which local exceptions and supplier risks remain unresolved, and who owns them?
- Q5
Can decision-makers communicate and act if normal systems are unavailable?
- Q6
What did the latest exercise reveal, and which corrective actions remain open?
Read the full paper
Move from a global policy to verified operating resilience.
The complete white paper includes reporting-obligation examples, supplier and data-flow guidance, an executive dashboard template, and a twelve-month implementation roadmap.