Call us now:
They say what goes around comes around, unfortunately for cybersecurity and cybersecurity risk management this is true. The book for cyber was written 10s of years ago and the paintings were put on the digital wall.
People way brighter than I made it clear through regulations such as FISMA and OMB A-130 that cybersecurity risk management was a major problem to be managed by U.S Federal Government, Standard writers like the ISO wrote the book on cybersecurity controls (ISO 27001). The Bank of International Settlements (BIS) set out requirements for banks to manage operational risk capital that included cyber risk (ever wonder why banks manage cyber, its coz they are regulated to). The SEC, through its final cyber rule and EU through EU NIS 2, DORA, and NYDFS have set the stage for covered entities to manage cybersecurity risk. For boards to demonstrate good corporate governance and for regulators to ask difficult questions of boards, about their risk management and cybersecurity practice.
The past 12 months has seen some doozy cyber and ICT incidents, MGM, United health, CDK, The NHS, Crowdstrike. We’re also seeing a focus by shareholders on corporate performance. Groundhog day it may be, but its also ‘I told you so’, and it’s only going to get worst as cyber accelerates across into the domain of national security; cyber regulations start to land fully across the EU and U.S and covered entities and their boards struggle with meeting regulatory commitments, that come with civil and criminal penalties.
Maybe the consideration is one of ‘how do we fix this problem’?
@Thaddeus Dziekanowski Brian D. McCarthy
Veritas GRC
#cybersecurity #cyberriskmanagement #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7230487271852896256