This may not be an issue corporate directors can avoid, as cyber regulation is being implemented in the U.S and EU.

← Back to Blog

This may not be an issue corporate directors can avoid, as cyber regulation is being implemented in the U.S and EU. Regulation that will affect companies that access U.S capital markets (SEC cyber proposal), CNI providers and their suppliers in the EU (EU NIS 2), Financial Institutions in the EU (DORA), medical device manufacturer’s that supply the U.S (Food and Drug Administration cyber regulation) and the proposed EU Cyber Resilience Act affecting ICT product and services manufacturers and distributors. Lets not forget my favorite cyber regulation from the U.S DoD, DFARS 252.204-7012. That has been on statute since December 2017 and affects covered Australian defense contractors and subcontractors.

While many may balk at tougher cyber regulation, it will be difficult to avoid. The other simple question to raise is that cyber is a national security, corporate security and economic security issue. One suspects corporate stakeholders will have an issue if companies they invest in are unable to trade in markets due to lack of cyber compliance, or board members may struggle if they are held liable for failing to comply to cyber regulation in the U.S or EU.

Companies in the U.S, EU and Australia are facing cyber regulation from all three jurisdictions. The conversation maybe one of harmonisation and standardization and not one of ‘shall I comply’ that needs to be had. While companies may try and control regulation within nations, they will not control it between nations. As they that control the market sets the standards of compliance for access to the market, and the U.S and EU are already setting the mood music.

Ted Dziekanowski Stephen Pitt-Walker, JD, FGIA

#cybersecurity #cyberriskmanagement #cyberregulation #cyberlaw #governance

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7058177332557008896