Page 44 - the SyI Quarterly 11

Cyber Updates
The pace of change of Cybersecurity
regulation and its impact on public and
private sector organisations.
By Andy Watkin-Child CSyP MSyI
Cybersecurity risk management is recognised
as a significant issue by many Governments
and legislators. Recent cyberattacks including
those on SolarWinds, JBS Meat, Kaseya, Colonial
Pipeline and Toyota demonstrate the impact of
cyber on supply chains. The average cost of a
cyber-attack increased in 2021 to $4.24 million,
from $3.86 million in 2020. 2021 saw the rise of
ransomware as the predominant cyber threat
vector confronting businesses of all sizes. Cyber-
insurance costs are increasing, coverage is
falling, insurers are adding policy exclusions or
cancelling policies if they cover the Ukraine Russia
conflict. The recent cyberattacks on Electronic
Arts, Microsoft, Samsung, Ubisoft, Nvidia and Okta
by the Lapsus$ group demonstrated that script
kiddies can successfully disrupt major brands.
In response the U.S. and EU Governments are
turning to legislation and regulatory regimes to
enforce cybersecurity compliance. The Securities
and Exchange Commission (SEC) proposed
amendments to its rules on 9th March 2022,
formalizing disclosure of cybersecurity risk
management, strategy, governance, and incident
reporting by boards of U.S. public registrants; the
Options Clearing Corporation (OCC) filed notice
with immediate effect of proposed rule changes
concerning the adoption of a cybersecurity
attestation program in June 2022; U.S. Federal
Government and their suppliers are required
to comply with the Federal Information Security
Modernization Act (FISMA – 2002, 2014 & 2022) for within four business days.
supply chain risk management. The Department
of Defence (DoD) requires global Defence Industry
Base (DIB) contractors and subcontractors
globally to comply with DFARS 252.204-7012,
7019, 7020 and implement the NIST SP 800-
171 cybersecurity standard. The EU is finalising
the Network Information Security 2.0 directive
(EU NIS 2.0) detailing a suite of cybersecurity
44
requirements that affect Critical National
Infrastructure (CNI) providers. The EU has issued
the draft Digital Operational Resilience Act (DORA
- 2022), regulating the governance, oversight, and
assurance of ICT risk management by EU Financial
Institutions (FI) and their ICT suppliers. All of
these legislative programs have similar regulatory
requirements and extend beyond their national
boundaries, touching organisations that are both
national and international. Requirements that
include:
• Reporting cybersecurity policies and
procedures, if any, for the identification and
management of risks from cybersecurity threats,
including whether the registrant considers
cybersecurity risks as part of its business strategy,
financial planning, and capital allocation.
• Confirming Board governance roles for
the oversight of cybersecurity risk. Detailing
management’s role in assessing and managing
such risk, management’s cybersecurity expertise,
and management’s role in implementing the
registrant’s cybersecurity policies, procedures, and
strategies.
• Implementing a cybersecurity risk
management framework and associated
cybersecurity program.
• Reporting material cybersecurity incidents
• Providing regulatory updates on
cybersecurity risk management compliance and
previously reported cybersecurity incidents.
• Undertaking independent testing of
cybersecurity risk management compliance.
• Undertaking an independent cybersecurity
assessment and certification before a DoD
contract is awarded.
The regulations are underpinned by enforcement
regimes that include the Department of Justices
(DoJ) Civil Cyber Fraud Initiative; Department of
Treasury OFAC rules for ransomware payments;
Basel accords for regulatory capital for covered
Financial Institutions; the Securities and Exchange
Commission (SEC) the EU Commission. U.S.
Federal Agencies adopt Whistleblower programs,
the government obtained more than US$5.6
billion in False Claims Act (FCA) settlements and
judgments in 2021. An act recently tested in court
with both the Comprehensive Health Services
(CHS) and Aerojet Rocketdyne cases citing DFARS,
as applied to the DoDs DIB contracts.
The developments in cybersecurity regulations
in the U.S. and EU impact both National
and International public and private sector
organisations. For organisations that trade with
the U.S. and EU there are clear expectations of
cybersecurity risk management compliance if
they are covered by specific regulations. Such
as implementing appropriate cybersecurity
risk management and cybersecurity programs,
boards implementing appropriate governance,
oversight, assurance, reporting and attesting to
their organization’s cybersecurity risk management and enforcement regimes drive cybersecurity ‘left
compliance.
Impact on National and International
organizations
Proposed U.S. and EU legislation set a high bar
for compliance, that organisations may find
challenging. Cybersecurity risk management and
cybersecurity have not been specifically regulated
with such breadth or depth by Nation states prior
to 2022. As demonstrated by the cybersecurity
regulations and standards that are currently
enforced in the U.S., UK and EU. Existing UK, EU
and U.S. data protection or cybersecurity laws
do not have the breadth or depth of data and
corporate coverage proposed by the SEC, EU
(DORA) and EU NIS 2.0 regulations. Requiring
covered entities to implement cybersecurity risk
management, board governance, cybersecurity
testing and report compliance to national and/
or international regulators. The proposed
cybersecurity risk management regulations will
require organisations to implement cybersecurity
risk management programs and practices that
are far more comprehensive than those that
are currently in place. Such as the DoD DFARS
program originally implemented in 2017, updated
in 2019 and in 2023 likely to require compliance
to NIST SP 800 – 171 prior to DoD contract award.
The SEC proposal will require boards of public
companies to implement, attest and report to
regulators their cybersecurity risk management
compliance, board oversight, assurance, and
cybersecurity competence. Likewise, DORA
and the EU – NIS 2.0 directive stipulate similar
cybersecurity risk management oversight,
assurance, attestation and reporting.
Driving ‘Left of Bang’, cybersecurity compliance
Cybersecurity risk management is not the same
as cybersecurity. Cybersecurity risk management
requires an understanding of inherent enterprise-
wide risk, control design and effectiveness, and
risk mitigation to affect residual risks. Managed
under a risk management framework. The
adoption of appropriate cybersecurity practices to
mitigate agreed risks, and formal reporting to key
stakeholder’s that include regulators and market
participants. The U.S. and EU regulatory proposals
of bang’, requiring cybersecurity risk management
compliance, rather than the traditional ‘right of
bang’ incident response and risk remediation post
incident.
Regulatory enforcement regimes will expose
organizations to a level of cyber scrutiny that they
have not had to deal with prior to regulation,
including regulating board member accountability
for cybersecurity risk management. The regimes
are being tested in court, setting precedence,
that will develop over time as cyber incidents are
evaluated in court against regulatory compliance
programs.