The impact of new EU security legislation

Based on a survey of organizations from the UK, France and Germany, FireEye found that many organizations in Europe are unprepared for and challenged by cost and complexity of compliance with new European Union (EU) security legislation.

The report assesses respondents’ understanding and expectations of the proposed Network and Information Security (NIS) and General Data Protection Regulation (GDPR) legislation. The GDPR is currently set to be finalized in early 2015, with compliance becoming mandatory in 2017.

The NIS directive – set to be implemented in 2015 – will impose new security and incident reporting requirements on a broader range of private sector companies.

The report also gauges how organizations perceive the scale and importance of the legislation and predicts how organizations in France, Germany and the UK are most likely to prepare themselves for compliance. Based on responses, it concludes that there is a mixed state of readiness at best, with many not understanding the true extent of the potential impact of the legislation.

Key findings include:

• Only 39% of organisations in France, Germany and UK indicated that they have all required measures in place for the NIS directive and less so for GDPR.
• Only two thirds (66 percent) of respondents believe their organisations fully understand the impact of the new NIS and GDPR regulations.
• The top concerns associated with serious data breaches and loss of personal information are potential fines (58 percent); damage to reputation (57 percent); and loss of business and/or revenue (58 percent).
• Over 60 percent of the organisations surveyed believe they are being provided little or no clear guidance on the legislation.
• 64 percent cited additional expenditure on hardware and software as a challenge, with 23 percent rating this as the single most important barrier to complying with the directives. Other barriers included implementation costs (58 percent) and policy complexity (56 percent).
• Most organisations (62 percent) expect that members of their own IT department will be tasked with assessing the NIS and GDPR requirements.

“The new EU security and privacy requirements are incredibly important and will greatly increase the security obligations of European organisations,” said Adam Palmer, International Government Affairs Director, FireEye. “We encourage organisations of all sizes to adopt mitigation measures that will manage risk stemming from zero-day exploits and never-seen-before malware as these attacks constitute a majority of advanced attacks in today’s threat environment. However, our research does show that organisations are not fully prepared for the implementation of the legislation, and it is critical these organisations begin preparing now to be in compliance and not be caught unprepared.”