The EU has taken a broad integrated approach to cybersecurity risk management regulation.

← Back to Blog

The EU has taken a broad integrated approach to cybersecurity risk management regulation. Be that through the EU Cybersecurity Act, EU NIS 2 Directive, Digital Operational Resilience Act (DORA), the Resilience of Critical entities Directive, the proposed Cyber Resilience Act or the EU Cybersecurity Certification of Cloud Services (EUCS).

Most companies in or outside the EU one speaks are unaware of most if not all these regulations. Regulations that will effect those that trade in or with the EU. That along with the EUCS require a clear articulation of what is adequate security and adequate compliance. Here in lies the problem as with the recent release of the SECs final cyber ruling. Adequate compliance has not been defined.

‘The EUCS supports three assurance levels as defined in the Cybersecurity Act: “basic”, “substantial” and “high”. The security requirements on cloud services and on their assessment increase with levels in several dimensions: scope, rigor and depth.’ But as yet undefined.

While not finalized the EUCS is still moving ahead to define the the tiers cloud providers and their customer have to provide and chose to secure EU data. It will likely define the security requirements for cloud providers in the EU, requiring providers to articulate what is adequate compliance and standards Ted Dziekanowski, thoughts?

#cybersecurity #cyberriskmanagement #cloudsecurity

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7111664855887011840