Call us now:
A useful summary of compliance with EU Cyber regulation by Phil Eicke, LL.M. For all the talk of what is required to comply. There is no precedent set for compliance, as the 27 EU member states have either not yet transposed the regulation, or those that have, have not yet completed the process for defining oversight and assurance.
Compliance with NIS is a legal regulatory issue. It requires a combined approach from legal, audit, cyber, and above all, governance by the board of a covered organisation. Boards carry the legal compliance risk directly as cyber regulation transfers the risk into the boardroom.
What makes the latest EU cyber regulations different from the past is that they come with Ex-Post and Ex-Ante audit. Allowing regulators to evaluate regulatory compliance when they decide it is appropriate, not the covered entity.
Companies can take a ‘wait and see’ approach to compliance, but it is not advised. Regulators can ask organisations to demonstrate their compliance and provide evidence at any time, not just when an organisation reports a cyber breach.
It is critical that organisations seek expert opinion, not rely on certificates of compliance. Cyber is a legal and compliance risk, not a security and technology risk.
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7425503023889674240