Most executives recognize the growing threat posed by cyberattacks, but few business leaders are putting the security strategy in place to help keep enterprise information safe and secure.
Although 94 percent of U.K. companies think the security of their IT systems is important, almost half (45 percent) do not have a formal security strategy in place, according to research from the Institute of Directors (IoD) and Barclays Bank.
The results of the survey raised concerns given the context of ever-increasing external threats and new legislative requirements, particularly the European Union’s General Data Protection Regulation (GDPR). IT decision-makers must ensure their business pays attention to policies and processes that can help reduce the risk of data exposure in light of these happenings.
Understanding the Need for Action
The research, which polled almost 1,000 business leaders, highlighted a general lack of preparedness among U.K. executives. Just one-third of business leaders use virtual private networks to help secure mobile communications, and only about half are familiar with two-factor authentication.
Education is another problem area for U.K. organizations. Just 44 percent have launched some kind of cyber awareness training. The report also found many organizations leave gaps of more than a year between running these training programs.
Even more troubling is the fact that as many as 40 percent of business leaders would not know who to contact to report online fraud. This lack of preparation and knowledge is a significant concern because of cybersecurity incidents during the past year and further legislative changes associated to the forthcoming GDPR.
Preparing for New Regulations
The GDPR is a new data protection framework that takes effect across Europe starting May 2018. It will expand the level of accountability organizations have for data breaches, and business leaders have to adhere to and prove they follow the principles of the framework.
All organizations will need to report data breaches to a supervisory authority within 72 hours and then to any affected individuals, explained Infosecurity Magazine. Failure to do so under the GDPR could result in fines of anything up to 10 million pounds or 2 percent of a firm’s global turnover.
These new regulations present a significant challenge to all businesses. And any lack of preparedness in terms of security strategies demonstrates how executives must start to formalize their policies and procedures.
Building a Better Security Strategy
In a news release, the IoD urged business leaders to step up their preparations for the GDPR now. It also advised that all directors and board members should be trained about the importance of a security strategy.
Additional research suggested the lack of preparation for GDPR stretches to other line-of-business departments beyond IT. About one-quarter of marketers believe their companies are unprepared, Marketing Week reported. Additionally, one-third do not expect to be compliant when the law comes into effect.
IT decision-makers and their C-suite peers should turn their attention to several key areas, including a thorough assessment of their organizational data and security audits to ensure any implemented security strategy is of the highest possible standard.