Could the EU cyber security directive cost companies billions?

Many of the world’s largest enterprises are not prepared for the new European Union Directive on cyber security, which states that organizations that do not have suitable IT security in place to protect their digital assets will face extremely heavy fiscal penalties.

The directive, which was adopted in July this year, will require that organizations circulate early warnings of cyber risks and incidents, and that actual security incidents are reported to cyber security authorities. Organisations that suffer a breach because they do not have sufficient IT security in place to protect their digital assets face fines of up to two percent of their annual global turnover.

However, a Ponemon Institute and Tripwire study, which looked at security management of 1320 IT security professionals working in healthcare and pharmaceuticals, financial services, the public sector, retail, industrial, services, technology, software and communications or education and research, revealed that most organisations are under prepared for the Directive and therefore at risk of being fined millions of pounds.

The overall findings from the survey were:

• 28 percent of organizations do not have a formal risk management strategy applied consistently across the entire enterprise
• Only 5 percent have a mature risk-based security management program
• Only 51 percent assess risks
• Only 58 percent assess vulnerabilities
• Only 58 percent identify threats.

Dwayne Melancon, CTO at Tripwire, said: “The new EU Directive has the potential to have a huge global impact because it applies to any organization which operates in the EU, even if they are headquartered elsewhere in the world. Countries have been given two years to put the EU Directive into place and organizations should be using this time to tighten their security programs; ensure that incident detection and response processes are in place and effective; and harden their systems, applications, and networks to reduce the risk of breaches.”

Other findings revealed that:

• Only 13 percent of organizations have regularly scheduled meetings with senior executives to discuss the state of the security risk with senior management
• 25 percent do not communicate security risks to senior executives
• 37 percent only communicate security risks to senior executives when a serious security incident occurs
• 49 percent believe they are not effective at communicating the facts about the state of security to senior executives.

“The size of the fines connected with the Directive are so big they will definitely get the attention of CEOs and boards,” continued Melancon, “It is incumbent upon senior business executives to seek clear answers about security risks from information security leadership to ensure appropriate steps are taken to enable compliance with this Directive before it takes effect.”

“This Directive is an excellent reminder that adopting a recognized set of security controls can significantly accelerate the implementation of a reliable security strategy,” said Melancon, “Organizations looking to improve security practices can also access a wealth of practical information through peer groups such as sector-specific ISACs (Information Sharing and Analysis Centres) where they can share methods and practices to improve their chances of achieving strong outcomes for cyber security.”