Call us now:
A great read, and to take 2 well used metaphors, ‘The horse has already left the stable’, and ‘We’re fighting the last war’. Ted Dziekanowski and I have written extensively about the need for international harmonisation across cyber. Incident reporting and data transfer are minor components of the challenges that nations face with cybersecurity, unless there are agreed and harmonized cybersecurity regulations and standards. Nations are already regulating cybersecurity across their public and private sectors that are much bigger than incident response and data transfer.
‘The horse has left the stable’ – The EU has passed cyber regulations under the EU NIS 2.0 and DORA. Regulations that set out requirements for CNI and FI organisation to implement cybersecurity risk management, governance, board ownership and incident declaration, with more regulation pending. The U.S SEC are expected to release regulation that will impact public and foreign registrants in quarter 1 2023, and the Australians have moved quicker than both of them with cyber regulation in the past 2 months alone. Breach reporting is the least significant and easiest issue to reconcile with harmonisation and there’s little hope of being able to get the horse back in the stable. But why care? Cyber regulations directly enforce ‘defensive cyber’, they impact national and international security, trade and governments offensive cyber capabilities.
‘We’re fighting the last war’ – We are focused on incident response and data transfer. That are a fraction of the issues that governments face and regulators aim to implement and enforce cybersecurity risk management requirements across the public and private sectors. Cybersecurity risk management, governance and strategy are big issues to resolve when 95% of organisations are SMEs. Videos by U.S National Cyber Director Chris Inglis explain what the problems are and hint at what the U.S will do about them, as does the recent NDAA 2023. Expect the U.S to regulate and if the SEC proposal, EU NIS 2.0 and DORA are anything to go by. Incident response is a small part of what is required to address the cyber problem.
The regulatory ‘train has left the station’ and ‘the genie is out of the bottle’ and it ain’t getting back in (oh metaphor heaven). It’s a difficult problem to address, regulation and enforcement regimes are being formed that impact the public and private sector, moving cyber ‘Left of Bang’, not right (incident response).
We’ve written extensively and created solutions for cybersecurity risk management, cyber strategy, board governance and attestation over the past 2 years some of which can be found at www.augustagrp.com.
#cybersecurity #cyberriskmanagement #leftofbang #cyberregulation #cyberlaw #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7007267239708000256