The regulatory agenda for cyber is forming quickly.

← Back to Blog

The regulatory agenda for cyber is forming quickly. The ONCD national cyber strategy is due in the coming weeks, the EU published NIS 2.0 and DORA, and is planning the Cyber Resilience Act (CRA). The DoJ, DoT and FTC have been pushing regulatory compliance regimes forward, and whistleblower programs are well publicised.

There are common themes to much of the U.S and EU regulation, that has been released or proposed.
1. The focus is demonstrating and attesting the management of cybersecurity risks through cybersecurity frameworks and programs.
2. Boards will be held accountable for the management of cybersecurity risks.
3. Reporting cyber incidents anywhere from 2 hours to several days is a requirement.
4. Civil and criminal penalties are to be considered by some national regulators when finalising regulations.
5. Some regulation allows for regulators to temporarily remove board members.

It is very clear that significant regulatory changes are taking place. The U.S National cyber director Chris Inglis has stated publicly that regulation is required to manage cybersecurity. I think that it is beyond any reasonable doubt that the SEC proposal will appear before May 2023.

I am not convinced that we have yet understood the breadth of industry sectors affected by the regulations, the impact on legal and compliance for both national and international organisations, and the impact on the leadership teams of those affected organisations. 2022 was an interesting year of legal precedence for cyber compliance. 2023 will be a year of cyber regulation, legal risk and change for cyber.

Ted Dziekanowski

#cybersecurity #cybersecurityriskmanagement #cyberregulation #theaugustagroup

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7022507133447385088