--- title: "The True Value of a Penetration Test: Legal Liabilities" description: Why is a penetration test necessary? Read this blog to find out. image: https://blog.goosmannlaw.com/hubfs/54736995_m.jpg --- [![Goosman Lawfirm](https://blog.goosmannlaw.com/hs-fs/hubfs/Goosmannlaw%20October2017/images/Goosmann_Law_Firm_logo_4C-white.png?width=1250&name=Goosmann_Law_Firm_logo_4C-white.png "Goosman Lawfirm")](http://goosmannlaw.com/) - [COVID-19 Toolbox](https://goosmannlaw.com/covid-19-resource-toolbox/) - Our Team - [Attorneys](https://goosmannlaw.com/attorneys/) - [Non-Attorney Staff](https://http://goosmannlaw.com/non-attorney-staff/) - Practices & Industries - [Practices](https://goosmannlaw.com/practices/) - [Banking & Finance](https://goosmannlaw.com/banking-finance/) - [Bankruptcy, Restructuring & Workouts](https://goosmannlaw.com/bankruptcy-restructuring-workouts/) - [Business](https://goosmannlaw.com/business/) - [Divorce & Family Law](https://goosmannlaw.com/divorce-family-law/) - [Employment](https://goosmannlaw.com/employment-law/) - [Environmental, Health & Safety](https://goosmannlaw.com/health-safety/) - [Estate Planning](https://trustlawcounsel.com) - [Gestational Surrogacy & Adoption](https://goosmannlaw.com/gestational-surrogacy-adoption/) - [International Law](http://goosmannlaw.com/international-law/) - [Litigation / Trial Law](https://goosmannlaw.com/litigation-trial-law/) - [Local Counsel](https://http://goosmannlaw.com/local-counsel/) - [Mergers & Acquisitions](https://goosmannlaw.com/mergers-acquisitions/) - [Rapid Response](https://goosmannlaw.com/rapid-response/) - [Industries](https://goosmannlaw.com/industries/) - [Agribusiness & Cooperatives](https://goosmannlaw.com/agribusiness-cooperatives/) - [Construction](https://goosmannlaw.com/construction/) - [Cyber Law and Telecommunications](https://goosmannlaw.com/cyber-law/) - [Education](https://goosmannlaw.com/education/) - [Health Care](https://goosmannlaw.com/health-care/) - [Manufacturing](https://goosmannlaw.com/manufacturing-law/) - [Multifamily Housing](https://goosmannlaw.com/multifamily-housing-law/) - [Non-Profit & Tax Exempt Organizations](https://goosmannlaw.com/non-profit-law/) - [Real Estate](https://goosmannlaw.com/real-estate/) - [Transportation](https://goosmannlaw.com/transportation/) - [Tribal](https://goosmannlaw.com/tribal/) - Our Firm - [Firm News](https://blog.goosmannlaw.com/firm-news) - Careers - [Attorneys](https://goosmannlaw.com/careers/attorneys/) - [Administration](https://goosmannlaw.com/careers/administration/) - [Internships](https://goosmannlaw.com/careers/internships/) - [Client Testimonials and Results](https://goosmannlaw.com/our-firm/client-testimonials-and-results/) - [Culture, Diversity, and Community](https://http://goosmannlaw.com/our-firm/culture-diversity-and-community/) - [Women-Owned Business](https://goosmannlaw.com/our-firm/women-owned-business/) - [Associations & Memberships](https://goosmannlaw.com/associations-memberships/) - [Firm History](https://goosmannlaw.com/firm-history/) - Blogs - [CEO Law Review](https://blog.goosmannlaw.com/ceo-on-your-side) - [Construction Lawyer](https://blog.goosmannlaw.com/construction-lawyer-on-your-side) - [Cyber Lawyer](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side) - [Deal Maker](https://blog.goosmannlaw.com/deal-maker-on-your-side) - [Divorce Docket](https://blog.goosmannlaw.com/divorce-lawyer-on-your-side) - [Food for Thought](https://blog.goosmannlaw.com/agricultural-lawyer-on-your-side) - [HR Legal Insider](https://blog.goosmannlaw.com/human-resources-on-your-side) - [Law Doc](https://blog.goosmannlaw.com/health-lawyer-on-your-side) - [Paralegal Review](https://blog.goosmannlaw.com/paralegal-review/) - [Real Estate Lawyer](https://blog.goosmannlaw.com/real-estate-lawyer-on-your-side) - [Risky Business](https://blog.goosmannlaw.com/risk-manager-on-your-side) - [The Banker’s Suit](https://blog.goosmannlaw.com/banking-lawyer-on-you-side) - [Trial Law Review](https://blog.goosmannlaw.com/trial-lawyer-on-you-side) - [Trust Law Counsel](https://blog.goosmannlaw.com/estate-planning-laywer-on-your-side) - Resources - [COVID-19 Resource Toolbox](https://goosmannlaw.com/covid-19-resource-toolbox/) - [Podcast](http://podcast.goosmannlaw.com/) - [Videos](https://goosmannlaw.com/videos/) - [FREE eBooks & Tools](https://goosmannlaw.com/free-ebooks-tools/) - Contact Us - [Office Locations](https://goosmannlaw.com/locations/) - [Sioux City Law Firm](https://goosmannlaw.com/locations/sioux-city-law-firm/) - [Sioux Falls Law Firm](https://goosmannlaw.com/locations/sioux-falls-law-firm/) - [Omaha Law Firm](https://goosmannlaw.com/locations/omaha-law-firm/) - [Spirit Lake & Spencer Law Firms](https://goosmannlaw.com/locations/spirit-lake-and-spencer-law-firm/) - [Real Estate Closings Office](https://goosmannlaw.com/locations/real-estate-closing-office/) - [Submit a Testimonial](https://goosmannlaw.com/submit-a-testimonial/) - [Sign Up for Our Newsletter](https://goosmannlaw.com/sign-up-for-our-newsletter/) - [Pay Online](https://goosmannlaw.com/pay-online-3/) - [  (855) 843-4531](tel:855-843-4531) ![](https://blog.goosmannlaw.com/hubfs/Blog_Images/Lockbox%20Lawyer/close-button.png) [tel:855-THE-GLF1](tel:855-THE-GLF1) [Cyber Law](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/cyber-law) [cybersecurity](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/cybersecurity) # [The True Value of a Penetration Test: Legal Liabilities](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/the-true-value-of-a-penetration-test-legal-liabilities) By [Goosmann Law Team](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/author/goosmann-law-team)   |  10, September 2018 [READ NOW](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/the-true-value-of-a-penetration-test-legal-liabilities) [Read Post](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/the-true-value-of-a-penetration-test-legal-liabilities#article) [![](https://blog.goosmannlaw.com/hs-fs/hubfs/Logos/Logo1.jpg?width=60&name=Logo1.jpg)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/author/goosmann-law-team) [Goosmann Law Team](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/author/goosmann-law-team)  Tags: [Cyber Law](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/cyber-law) [cybersecurity](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/cybersecurity) ## The term "Penetration Test" is used quite a bit, but what does the term mean? What is the value of the test for a small or medium sized company? Is the test necessary? And, why is a lawyer writing about this? Penetration tests, or pen-tests, are conducted by computer network experts to test a computer network's vulnerabilities to outside threats. The pen-test can be conducted by consultants hired by the company or internal IT personnel to test their own company's network. A typical test will run a series of programs across a network to determine IP addresses, ports, services, programs, operating systems, and more, and provide a list of systems or programs that may be vulnerable to an attack. As an example, a test may show that an employee has an FTP program running on their computer. The test may show that the program is unauthorized and may expose files on the computer to an exploitation and to even copying or exfiltration of the data from the network. At its most basic level, a penetration test is conducted to find IT vulnerabilities before a malicious hacker exploits a vulnerability to the detriment of the company. An exploitation of a threat and loss of data then can have significant consequences for a company. An IT vulnerability by itself is not the biggest cause for concern, however. The biggest cause for concern for any company should be the legal liability that accompanies the loss of the data. Losing the data of a client, customer, or vendor, can lead to legal liabilities under federal, state and, believe it or not, foreign law. The General Data Protection Regulation (GDPR) can potentially apply to any organization that does business with a citizen of the European Union. Violations of the GDPR can result in severe penalties. The potential for significant fines and liabilities can be hefty enough to put any company out of business, but, based on this heightened threat to small and medium sized businesses this even more concerning. Cyber threats and the resulting liability will have the biggest impact on small to medium sized companies because they do not employ a permanent IT staff and most likely do not have a CSO or CISO. This isn't to say that the largest companies aren't targets of cyber threats - they are and they have a lot to lose if a cyber-attack is successful - but, larger companies also tend to have the best budget for an IT staff, a CSO or CISO, the most money to spend on education, prevention and new gadgets, gizmos, doodads, and whatsits designed to protect their network and IP holdings. Furthermore, larger companies are better positioned to withstand and absorb significant financial and legal consequences. A small company could be putting their entire business at risk by being connected to the Internet. A simple hack could steal their intellectual property, put their computers in a state of non-use if ransomware is installed, expose customer's or vendor's information to the hackers, subject the company to civil fines and penalties, and, in the worst-case scenario, force a company out of business. Thus, a pen-test is worth significantly more than a list of IT vulnerabilities, it is a list of legal liabilities. This is where a cyber lawyer may be able to help. A knowledgeable cyber lawyer consulted before a penetration test is conducted could potentially help with several matters, including: - The necessity of the scheduled tests - The scope of the test, e.g. which systems and which tools - The liability for any indirect, punitive, special, incidental, or consequential damage caused by test (think of computer downtime) - Non-disclosure agreements - Ownership of the results or data When the test is complete a cyber attorney should also be able to look at the results and put a value on the legal liability to the company. The costs or value of legal liability of data breach could include: - Legal costs if a potential breach includes PII, ePHI, or PCI - Potential civil fines - Legal obligations to clients, employees, partners, and regulators - Applicable notifications under federal or state law - Time and notification constraints - Law enforcement notification - Contractual obligations to private parties These are just a few of the issues a lawyer can help answer when considering a penetration test or in reviewing the results from a penetration test. Legal analysis can enable a company to place a value on the vulnerabilities and legal liability and intimately aid in business decisions such as how much cyber insurance to purchase, whether to upgrade the computer systems, purchase additional software, or whether to hire additional personnel. After all, the whole reason for the penetration test is to determine if vulnerabilities will lead to legal liabilities; or, to put it another way, if there were no legal liabilities does anyone care about IT vulnerabilities? Visit our [Cyber Law blog](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side) for more interesting updates on how the law is developing with the change and growth of technology. Have any questions or comments? Contact our Sioux City, Sioux Falls, or Omaha office today! [![CONTACT US](https://no-cache.hubspot.com/cta/default/489404/60d77596-fa6c-4cb1-a3bf-b2fb87ab9210.png)](https://cta-redirect.hubspot.com/cta/redirect/489404/60d77596-fa6c-4cb1-a3bf-b2fb87ab9210) ### Select Different CTA for each Post from Blog Editor [![New Call-to-action](https://no-cache.hubspot.com/cta/default/489404/a8cefc17-3b9d-4de0-89cd-e60a64752422.png)](https://cta-redirect.hubspot.com/cta/redirect/489404/a8cefc17-3b9d-4de0-89cd-e60a64752422) ### Subscribe Our Blog Thanks for submission!! - Recent - Popular ### Posts by Topic - [Cyber Law (43)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/cyber-law) - [cyber (7)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/cyber) - [cybersecurity (5)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/cybersecurity) - [Business News and Insights (4)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/business-news-and-insights) - [Cyber Law Trends (3)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/cyber-law-trends) - [Firm News (3)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/firm-news) - [Media Law and Technology & Science (3)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/media-law-and-technology-science) - [CEO (2)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/ceo) - [Communications Law (2)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/communications-law) - [Cyber scams (2)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/cyber-scams) - [EMV Credit Cards (2)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/emv-credit-cards) - [HR Legal Insider (2)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/hr-legal-insider) - [CFAA (1)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/cfaa) - [Communications Decency Act (1)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/communications-decency-act) - [Cyber Legacy (1)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/cyber-legacy) - [DNA (1)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/dna) - [Employee Recruiting (1)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/employee-recruiting) - [Employment News and Insights (1)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/employment-news-and-insights) - [IRS (1)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/irs) - [IRS scam (1)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/irs-scam) - [IRS scam Sioux City (1)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/irs-scam-sioux-city) - [Identity Theft (1)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/identity-theft) - [Ransomware (1)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/ransomware) - [Sioux City IRS scam (1)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/sioux-city-irs-scam) - [South Dakota (1)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/south-dakota) - [data breach (1)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/data-breach) - [scam (1)](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/topic/scam) DISCLAIMER: The information in this blog post (“post”) is provided for general informational purposes only, and may not reflect the current law in your jurisdiction. By visiting this website, blog, or post you understand that there is no attorney client relationship between you and the Goosmann Law Firm attorneys and website publisher. No information contained in this post should be construed as legal advice from Goosmann Law Firm, PLC, or the individual author, nor is it intended to be a substitute for legal counsel on any subject matter. No reader of this post should act or refrain from acting on the basis of any information included in, or accessible through, this Post without seeking the appropriate legal or other professional advice on the particular facts and circumstances at issue from a lawyer licensed in the recipient’s state, country or other appropriate licensing jurisdiction. #### Let Us Know What You Thought about this Post. Put your Comment Below. [Previous Post](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/new-california-data-law) ##### [New California Data Law](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/new-california-data-law) [Next Post](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/whats-your-encryption-description) ##### [What’s Your Encryption Description?](https://blog.goosmannlaw.com/cyber-lawyer-on-your-side/whats-your-encryption-description) ### Contact Info **Sioux City Location** P. 712-226-4000 F. (712) 224-4517 **Sioux Falls Location** P. (605) 371-2000 F. (605) 275-2039 **Omaha Location** P. (402) 280-7648 F. (402) 505-3967 --- [Disclaimer](http://goosmannlaw.com/list-all-blogs/disclaimer/) | [Privacy Policy](http://goosmannlaw.com/privacy-policy/) ### Locations **Sioux City Location** 410 5th Street Sioux City, IA 51101 **Sioux Falls Location** 5010 S. Minnesota Avenue, Suite 100 Sioux Falls, SD 57108 **Omaha Location** Advent Building 17838 Burke Street, Suite 250 Omaha, NE 68118 ![Goosmann](https://blog.goosmannlaw.com/hs-fs/hubfs/Blog_Images/Lockbox%20Lawyer/goosmann-white.png?width=250&name=goosmann-white.png "Goosmann") Goosmann Law Firm is a FULL SERVICE LAW FIRM with locations in Sioux City, Iowa, Sioux Falls, South Dakota, and Omaha, Nebraska. Goosmann Law attorneys are licensed to practice in Iowa, Nebraska, South Dakota, and North Dakota. Their attorney team's practices and industries include but are not limited to Agribusiness and Cooperatives, Banking and Finance, Bankruptcy, Restructuring and Workouts, Business, Construction, Cyber Law and Telecommunications, Divorce and Family Law, Education, Employment, Environmental Health and Safety, Gestational Surrogacy and Adoption, Health Care, Litigation and Trial Law, Manufacturing, Mergers and Acquisitions, Municipal, Nonprofit and Tax Exempt Organizations, Real Estate, and Transportation, Tribal, Wills, Trusts, Estate Planning, and Probate Law. Goosmann © Copyright 2017