Call us now:
The EU and its public and private sector organisations face a more significant issue from cyber regulation. While the EU has recently released the EU NIS 2.0 directive and a draft proposal for Digital Operational Resilience Act (DORA), requiring tighter management and control of ICT risk management and cybersecurity. They focus upon Critical National Infrastructure providers and Financial Services.
For UK and EU companies the problem is more complicated.
1. Defence contactors must comply already with US DoD DFARS requirements, requiring NIST SP 800-171 cybersecurity compliance. The DoD is planning, starting in 2023, to require an independent CMMC certificate before a contract is awarded.
2. The SEC has announced a significant proposal for Cybersecurity Risk Management for public firms on U.S. markets, including foreign issuers. Affecting U.S. public companies located in the UK and EU.
3. Both U.S. programs are backed by the Department of Justices (DoJ) Civil Cyber Fraud Initiative and Whistleblower program. That is being tested in U.S. courts.
All this legislation, regulation and enforcement comes at a time when there are few skilled resources; UK and EU cybersecurity standards do not enable compliance; and many companies require guidance and a strategy to comply with cybersecurity risk management. Cybersecurity risk management oversight and assurance is required across supply chains, no mater how big or small the suppliers.
Ted Dziekanowski
#cybersecurity #cyberriskmanagement #governance #compliance #securitiesandexchangecommission #dora #eunis2
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6940922650932199425