GDPR is less than a year away, with many boards getting their cyber ducks in row to ensure compliance come May 2018. Although boards have ramped up their cyber efforts and prioritised cyber security, it seems that the majority are still unprepared when it comes to training in how to respond to attacks.
According to a KPMG survey carried out as part of the Government’s Cyber Governance Health Check, over half (54%) of FTSE 350 businesses place cyber risk as a top group risk when compared with other threats that a company faces – up from 29% in 2014.
In a positive sign for the post-GDPR world, boards are also more likely to debate and agree their tolerance for cyber risk than in previous years, with more than half (53%) ) have this “clearly set and understood”. This is up from 33% in 2016.
However, although boards are recognising the importance of cyber security, over two-thirds (68%) have not received any training to deal with a cyber incident. A shocking 2% of those surveyed said that they had received comprehensive training and, more worryingly still, 10% of businesses revealed that they do not have a plan in place to respond to a cyber incident.
“Cyber-attacks continue to pose a growing threat to business. While cyber security has cemented itself onto the board’s agenda, they often lack the training to deal with incidents,” said Paul Taylor, UK head of Cyber Security at KPMG.
“This is hugely important as knowing how to deal confidently with an incident in the heat of the moment can save time and money. The aftermath of a cyber-attack, without the appropriate training in managing the issue, can result in reputational damage, litigation and blunt competitive edge.”
The survey findings also reveal a gulf in GDPR understanding, with 46% of FTSE 350 boards still not reviewing and challenging reports on the security of their customer’s data. Although 71% of businesses would confidently say that they are somewhat prepared for GDPR, a mere 6% actually confident enough to say they are completely prepared.
Respondents cited an individual’s rights to personal data deletion as the biggest concern in terms of meeting GDPR compliance.
“It’s worrying that with less than a year to go, many organisations still have a lot to do. GDPR will affect organisations in the UK and worldwide that have any dealings with consumers and businesses in EU member states,” said KPMG’s Taylor.
“The regulation sets a new bar for customer and client privacy expectations, but the truth is that many just don’t understand what they have to do and how to deal with it.”
“Boards need to take GDPR as a warning to rethink how they collect, store, use and disclose personal information. Done right this can transform their business model helping match services to client needs, done wrongly then they run a growing risk of data breaches and subsequent enforcement action with the prospect of fines up to 4% of global turnover.”
The survey also put the spotlight on the lack of information given to boards – the decision makers of an organisation. Of those surveyed, 53% of boards receive only some information on cyber risk.
READ MORE: GDPR and market boom to send IT security spending soaring – Gartner
Just 31% of FTSE 350 boards receive comprehensive and informative management information on cyber risk, with 57% of businesses have a clear understanding of the potential impacts resulting from a cyber incident.
“Board members need to take collective responsibility for cyber security and consider it in every aspect of the business. If they can do that, then perhaps cyber security will become mainstream and a vital component of doing business in our digital world,” said Taylor.
