GDPR spurs companies to boost cybersecurity precautions

The rapidly approaching enforcement of the new General Data protection regulation in May 2018 has spurred companies across the UK to up their efforts to become compliant. A new study finds overlap between companies that have or are becoming compliant and improved cybersecurity behaviours – strengthening wider consumer and company data defences.

Cybersecurity has become an increasingly pressing issue, with businesses susceptible to various forms of attack – from direct hacks to social engineering. The threat landscape continues to evolve, with two major vulnerabilities, Meltdown and Spectre, recently uncovered, while attack vectors continue to rise. In terms of impact, one recent study placed global economic damage in the order of $440 billion, while businesses collectively foot a $280 billion bill for failures.

Given the risk to customers and clients from breaches of personal and sensitive information, governments in Europe developed the GDPR, which, when enforcement begins next May, impose stiff penalties on companies that do not meet compliance standards.

Readiness for the GDPR among businesses affected and cybersecurity complement each other – finds a new Marsh study, titled ‘GDPR Preparedness: An Indicator of Cyber Risk Management’, into current industry trends. The study involved 1,300 executives representing a range of industries and organisations worldwide.

The new legislation is one of the most sweeping changes to privacy rights and obligations to have taken place in years. The policy, which will significantly bolster EU residences’ rights regarding information about them, also offers a strong background for cybersecurity – with encryption becoming the norm while requirements for breach reporting (within 72 hours) bolsters event management capacities.

However, while being GDPR compliant creates a strong background posture for cybersecurity, current compliance levels remains relatively low – 8% say that they are currently fully compliance, while 57% say that they are developing a plan to become compliant, while 11% say that they have no plan.

The difference between companies that are fully compliant and have no plan in terms of key cybersecurity practices, is relatively stark. The number that have developed a cyber incident reporting plan stand at 49% for fully compliant and 10% with no plan, while for encrypted computers the difference is 69% and 38% respectively. Fully compliant firms were also found to be three times more likely to adopt some cybersecurity measures and four times more likely to adopt a cyber resilience measure.

Organisations continue to face considerable threat from the adversaries. In the past 12 months, 23% of respondents subject to the GDPR said that they were the victim of a successful cyberattack. Opening them up, when such breaches affect users’ privacy, in potentially stiff fines.

The new rules will push companies to as best they can, to prepare their businesses for a more robust care for the rights of customers to privacy and personal security. The companies preparing themselves for compliance with the GDPR were also found to investing more to address cybersecurity related risks than companies with no plan. 78% of respondents in ‘compliance or developing a plan’ said that they have increased spending, while 18% say that spending is flat – for the no plan group spending increases stood at 52% while 38% said that it remained flat.

In terms of the completion of 14 key cyber risk actions taken by the different groups, the ‘compliance or developing a plan’ was much more likely than the ‘no plan’ group to have completed 10-14 actions, 22% and 9% respectively, while in the 4-9 actions segment, 54% and 36% respectively were said to be completed. A large number of ‘no plan’ respondents, 47%, have completed 0-3 steps.

The GDPR has also structured companies seeking to become compliant into various cybersecurity risk management actions. For instance, when comparing companies that have no plan and those that say that they are compliant or are developing a GDPR plan, 38% verses 56% said that they encrypt organisational desktop and laptops – something explicitly encouraged by the GDPR. While 17% and 56% said that they have engaged in penetration testing, something strongly implied by the GDPR.

Other cybersecurity management actions include conducting a cybersecurity gap assessment, cited by 38% and 67% respectively, and implementing / enhancing phishing awareness training for employees, cited by 50% and 66% respectively.