Call us now:
A nice article from the Harvard Business Review on the challenges of cyber compliance. That goes some way to explaining why cyber compliance is a complex risk to manage.
Cybersecurity risk management is recognised by the World Economic Forum as one of the top non-financial risks and terminology we use for cybersecurity is often nondescript, and belies its complexity. Cyber regulation is here and requires boards to understand and manage cyber risk, and cybersecurity is just one component of managing cyber risk. In a simple example one only has to look at the U.S DoD DFARS/ CMMC program, that requires defence contractors to manage and attest 110 cybersecurity practices, with over 300 control criteria, for baseline compliance. It is an expensive program of work for any organisation, and with 99% of businesses being SMEs, a difficult task.
With cyber regulation on the EU journal, as of January 2023. The SEC cyber security proposal pending, and the Australian Government actively developing regulation that is focused on cybersecurity risk management, board accountability and responsibility. Boards of covered entities may not have the luxury of waiting, the FUD debate has left the table and board legal and compliance risk is increasing.
Cyber regulation transfers cyber compliance ‘Left of Bang’, creating legal and compliance risk, and cyber insurance cannot be relied upon to cover an organizations inherent risk.
Ted Dziekanowski Stephen Pitt-Walker, JD, FGIA Rachel V. Rose, JD, MBA
#cybersecurity #cyberriskmanagement #legalrisk #regulatoryrisk
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7065234542516674560