Call us now:
Thank you, Bryan Foss. One was the counsel appointed cyber and risk expert and advisor to the ICO several years ago, on several cases, and one has presented several times to UK APPGs on cyber.
The first point to recognise is that the ICO’s role is to evaluate compliance with existing regulation. As such, the ICO has no accountability for the Ex Ante audit of corporate compliance to UK regulation, which in any case only extends to GDPR, nor does the ICO have the knowledge, skills, or experience to evaluate compliance beyond data breaches under GDPR, to the broader sphere of cybersecurity.
To answer the question, how realistic is it for the ICO to audit compliance? One only has to look at EU NIS 2, as it is now required by all 27 EU member states, to answer the question. EU NIS 2 enables ex-ante (and ex-post) audit by EU regulators of cybersecurity risk management compliance of CNI providers across all EU member states. To put that in perspective, that’s 27 member states that are implementing their own cyber regulators, which can audit cybersecurity risk management governance of around 150,000 companies. EU DORA also regulates the audit of FIs across the EU. The US SEC final rule requires oversight and assurance of cyber by covered company boards. In fact, most cyber regulations globally require audit under the 3 Lines of Defence Model.
If the UK had a cyber strategy, appropriate cyber regulation, and educated enough people on cybersecurity risk management. Put UK boards under regulation and have the appropriate regulator, then it could audit the UK industry. At present UK struggles with cybersecurity regulation, and would struggle with ex ante audit. But it is an issue being addressed by partner nations.
@Thaddeus Dziekanowski Brian D. McCarthy Faisal Khan
Veritas GRC APPG for Cyber Innovation
#cybersecurity #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7386705309895122944