Call us now:
One is not sure that the energy market is going to be able to avoid cybersecurity for much longer. EU NIS, the SEC proposal and Australians CNI cyber regulations lay the ground for cybersecuirty risk management compliance.
With ONCD making clear that cyber is a national security issue and regulators focusing on CNI, the energy sector will be required to improve its cybersecurity posture. Or face sanctions from U.S and EU regulators, sanctions that include options for both civil and criminal penalties for individuals and companies (EU NIS 2). Furthermore if and when the SEC cyber proposal becomes final, then boards of covered entities may find themselves exposed such as Vestas Wind systems that are listed on U.S capital markets.
Being cybersecure won’t help in the short term, having cybersecurity is not the same as having cybersecurity risk management. Boards will have to step up and demonstrate their cyber strategy, governance, oversight and assurance, incident reporting and declare their personal knowledge and experience in cybersecurity risk management. Cybersecurity is one component of cybersecurity risk management.
Regulation will also have an effect on cyber insurance. Where once organizations could rely on cyber insurance for risk transfer, by demonstrating cyber compliance they will directly communicate their cyber capabilities to regulators. Providing cyber insurers with public information they and legal counsel can use in the event of a cyber attack.
Ted Dziekanowski Rachel V. Rose, JD, MBA Stephen Pitt-Walker, JD, FGIA
#cybersecurity #cyberriskmanagement #criticalnationalinfrastructure #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7072116205301424128