Ask a CISO when legal gets involved in a security project, and the answer is usually some version of “at the end.” Ask legal when they hear about a new technical setup, and you get the same.
Both teams are doing good work – they are just not collaborating.
As the world moves, gaps appear. Not from a lack of competence, but from a lack of contact. Legal commits to obligations security cannot deliver. Security builds controls that create exposure nobody flagged. By the time either team finds out, the fix costs far more than the conversation would have.
The language problem
Law and IT best practices do not share vocabulary. Legal texts are written to be interpreted, not always implemented directly as regulatory requirements may not be able to cover all technical aspects and development over time.
When GDPR requires “appropriate technical and organizational measures” that sound technical. It is not. What counts as appropriate in the eyes of a regulator is a legal judgement based on legal definitions, not a risk matrix nor IT best practices, though it is often recommended to follow recognized international standards.
NIS2 follows the same logic. Its incident reporting obligations assume detection of maturity that many organizations are still building. That gap requires the security team and legal specialists to be in the same room.
When they are not, everyone fills the silence with assumptions. Security assumes legal will flag the contractual implications. Legal assumes security has handled the technical side. Those assumptions compound until an audit, a breach, or a regulatory inquiry makes it visible.
Friction is useful
There is a tendency to treat cross-functional disagreement as a problem to manage. It is one of the more valuable things that can happen in a room. When a security architect pushes back on a contractual requirement, and a lawyer pushes back on a proposed control, both are forced to think harder. The solution that comes out is usually more durable than anything either team would have reached separately.
This kind of conversation rarely happens in formal settings. It happens when people know each other well enough to say, “I think you are missing something here.” It happens in more informal surroundings, e.g. over lunch, a cup of coffee, or at the bar Friday after work. Relationships that make it safe to challenge each other across professional boundaries are not nice-to-have. They are a prerequisite for good decisions.
When the room is good, the work is better
Organizations that build genuine working relationships between legal, compliance, and cybersecurity catch conflicts earlier, build controls that hold up technically and legally, and have clear answers when regulators start asking questions.
The organizations that struggle most are rarely the ones lacking good people. They are the ones where those people never quite talk to each other.
When did your legal and security teams last speak outside of a deadline or an incident?
If you are not sure, that is probably your answer. Schedule an event at a bar Friday after work, meet up and see the real magic happen.
About Mikael Hansen
About Sten Skov Lehnert
Sten is Senior Security Advisor and brings more than 29 years of experience in IT operations, risk management, leadership, and cybersecurity. He advises organisations on governance, cyber resilience, and compliance, with a particular focus on NIS2, ISO 27001, and GDPR. As co-author of a textbook on NIS2 and an external lecturer for the NIS2 Master Certificate programme at the University of Copenhagen and Djøf, he combines deep regulatory expertise with hands-on experience from both public and private sector organisations.