Call us now:
Are there any alternative standards? When one ponders the question through the lens of British Industry. The question is not ‘Are there any alternative standards’, but how will UK industry comply to the cyber regulations implemented by international regulators. Cyber regulatory compliance requires UK industry address all the equivalence test identified in the document below and more.
If one examines the Securities and Exchange Commissions (SEC) Final Cyber rule, that UK firms listed on U.S Capital Markets are required to comply. The Cybersecurity requirements set out by the Federal Drug Administration (FDA) for medical device manufacturers. The U.S DoD DFARS program and CMMC. EU NIS 2, the Digital Operational Resilience Act(DORA) or the EU Cyber Resilience Act. Many of which effect UK industry and come with civil, criminal and/or contract penalties. Would cyber essentials enable a UK firm comply? No it would not.
The SEC rule, EU NIST 2 and DORA require covered entities demonstrate cybersecurity risk management compliance. Compliance requiring both a Risk Management Framework and cybersecurity standard. DoD CMMC requires a companies implement 110 cyber controls, self assess and potentially undergoe an independent audit (Cyber Essentials has 5 controls).
Failure to comply with the SEC Final Rule, NIS 2 and DORA can lead to significant corporate and personal penalties. Compliance requires firms implement as many cyber controls as necessary to manage cyber risk, be that 5 or 155 controls with board oversight, assurance and attestation. Regulators and markets will determine if a company has done enough to manage risk, as will the hackers.
The question is not one of ‘Cyber Essentials: are there any alternative standards’, the question is what frameworks and standards does UK industry need to adopt to comply with international cyber regulation, be that risk management or cybersecurity. And don’t get Ted Dziekanowski started on cloud security.
Brian D. McCarthy George Sawyer Rich Waite, M.Ed.
Veritas GRC
#cybersecurity #cyberriskmanagement #cyberregulation #cybergovernance #iso27001 #nist
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7155849133147234304