As cybersecurity threats become more sophisticated, security leaders are facing the challenge of complying with complex and ever-changing regulations. Failing to meet these objectives can have serious consequences for brands and finances, leading many IT leaders to seek help from external vendors.
The World Economic Forum has recognized the acute challenge businesses face in managing cybersecurity regulations and has called for global harmonization of these regulations. While regulations are important for ensuring the safety of businesses and consumers, they also require businesses to seek expertise in understanding and improving their IT systems to comply with the new requirements.
The NIS Directive revision, known as NIS2, has recently come into force, placing responsibility on management bodies to approve measures for dealing with cybersecurity risks and imposing stronger incident reporting obligations. Although NIS2 does not directly apply in the UK, the government has announced plans to reinforce its own NIS rules. The UK Cabinet Office has also launched the GovAssure scheme, which conducts IT security audits in government departments to assess their “cyber health” against robust criteria.
In Europe, the proposed Cyber Resilience Act by the EC would introduce mandatory cybersecurity requirements for makers and sellers of products or software with a digital component, ranging from baby monitors to IoT devices.
Mike Pimlott, VP of Global Managed Security Services at NTT, highlights the challenges companies face in keeping up with existing and incoming regulations. He warns that the distractions of regulatory compliance can actually contribute to cyber risk exposure and lead to data breaches that prompt governments to introduce even more regulations.
Organizations also face additional vulnerabilities, both technological and procedural, when their cyber posture is assessed. Pimlott explains that companies may discover data assets they were previously unaware of, which are now subject to new protection laws. This requires companies to quickly secure these assets to remain compliant, adding to the workload of already overworked CISOs and their teams.
Pimlott believes that the increasing regulatory burden will force enterprises to reconsider their approach to managing cyber risk. He suggests that organizations may need to upgrade their infrastructure to pre-secured hardware and software that is built to comply with the latest regulations, rather than relying solely on patching known vulnerabilities.
In the meantime, enterprises can seek support from technology partners like NTT, which offers managed detection and response (MDR) services. These services not only free up in-house IT security experts to focus on more valuable projects but also provide customized security support based on the regulatory requirements of specific markets or industries.
Learn more about NTT’s Managed Detection and Response solution here.