How companies can deal with the increase of EU Tech regulations
Stijgende regelgeving zoals GDPR, NIS en DORA belast bedrijven steeds sterker. Cyberrisico's en de regelgeving daarom heen versterken dit. Zogenaamde in-controlverklaringen kunnen de druk op zowel bedrijven als toezichthouders verlichten.
By Yuri Bobbert
The number of enterprises subject to regulatory requirements has increased significantly under existing and new legislation such as the EU General Data Protection Regulation (GDPR), the Security of Network and Information Systems (NIS) regulations NIS1 and NIS2,[1] and the EU Digital Operational Resilience Act (DORA).[2] Last week Mario Draghi warned these EU legislations are “killing our companies”.[3] Likewise, cyberrisks adds complexity for business owners, investors, financiers, necessitating more thorough due diligence regarding an enterprise’s technology stack. Supervisory bodies will face significant challenges due to talent- and knowledge scarcity and an old-fashioned way of working. Proactive in-control statements put the burden of digital-assurance proof on the company rather than the supervising bodies. I expect this will significantly relieve both entrepreneurs and supervisory bodies.
What Is the Problem, and Who Is Affected?
Regulatory and industry requirements related to cybersecurity are skyrocketing. They include standards imposed by De Nederlandsche Bank (DNB), DORA, the European Union (EU) Cyber Resilience Act,[4] NIS2[5], the SWIFT Customer Security Programme (CSP),[6] US Federal Risk and Authorization Management Program (FedRAMP)[7], International Organization for Standardization (ISO) standard ISO 27001, the Center for Internet Security (CIS) Critical Security Controls[8], the US Federal Information Security Management Act (FISMA),[9] the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53[10], Cloud Security Alliance Capability Assessment Model (CSA CMM)[11], American Institute of Certified Public Accountants (AICPA) Trust Service Criteria (TSC)[12] and the Payment Card Industry Data Security Standards (PCI DSS)[13] etcetera. Managing all these regulations is a complex process for enterprises and regulators who need to supervise their correct implementation. The number of enterprises affected in the European Union alone runs into the millions (Figure 1).[14]
[....]
