Regulation and the need for operational resilience

Richard Cassidy at Rubrik discusses how the latest regulations will shape a new era for business operations

 

Data growth is a fact of life across many industries. Rubrik Zero Labs data shows that the average organisation currently holds 240 BETB (back-end terabytes) worth of data, and this is projected to grow seven times over within the next five years.

 

While this rise in information will create a lot of exciting opportunities for many organisations and industries, it’s not without data management challenges. 

 

If data growth is left unchecked, free to develop in an unmanaged way, blind spots will form. For industries where data security is particularly crucial, such as healthcare, education and financial services, this is a particularly serious challenge that promises serious consequences. Fortunately, these new regulations are designed to help CISOs.

 

What does operational resilience really mean?

Every day, new threats to a business’ reputation, security and financial stability emerge. These threats could be scams; ransomware, DDOS attacks or malign vectors we’re simply not aware of yet.

 

In simple terms, operational resilience is an organisation’s ability to prevent, adapt, respond to, recover, or learn from threats and disruptions. It’s how hard a business is to knock down, and how quickly it can get back on its feet.

 

Clearly, in the digital age, operational resilience is of the utmost importance, which is why certain regulations are coming in to essentially enforce it. The Digital Operational Resilience Act, or DORA, is an EU measure designed to protect the financial sector against operational disruptions and cyber-attacks. This is as financial services organisations already hold 20% more data on average with around 288 BETB worth.

 

When it applies from the start of next year, it will require domestic and international companies to plan for and then deliver operational resilience. Essentially, it represents a shift in the way in which we approach resilience, and works to support the financial services industry against cyber-risks, where data protection is even more critical, potentially of national security. 

 

What other new regulations are coming?

Alongside the arrival of DORA, it’s important for organisations to be aware of the NIS2 (Network and Information Security) Directive. This update to the Security of Networks & Information Systems Regulations is the latest in a series of data protection regulations specific to organisations doing business with the European Union (EU) and UK organisations, deemed part of a nation’s critical infrastructure.

 

That means businesses handling national assets, essential for the functioning of society, such as energy, water, transport and healthcare. The NIS2 regulation essentially enforces co-operation on security and heavily incentivises a culture of high security.

 

These regulations are an invaluable help for CISOs in their day-to-day roles, helping to identify the potential blind spots as data grows, and providing a solid framework to develop solid action plans in the event the worst was to happen. Collaboration with boards of directors and senior leadership adds an additional level of confidence in an organisation’s operational resilience. 

 

What are the motivations to increase resilience?

It’s one thing to regulate for higher resilience…It’s another thing entirely to see it through. The impetus is on businesses and organisations to take the steps necessary to ensure their security and longevity, meeting the regulations expected of them in the process.

 

But the motivation is most certainly there. With new regulations such as DORA and NIS2 applying financial and reputational pressure, and the increased variation and sophistication of threat actors across the globe. There’s no time like the present to act ahead of their respective deadlines of 17th January 2025 and 17th October 2024.

 

Cyber-criminals and state-sponsored actors see data as a prime target across industries. The education sector, for example, holds 19% more data on average, around 286 BETB worth. Regardless of their motivation, if cyber-criminals can find a way to access it, they will. 

 

In fact, 62% of UK organisations suffered loss of sensitive data in the last year, higher than the global average of 53%. Much of this data is down to the increasing use of big data tied to IoT, AI and the vast amount of devices that are used day-to-day. 

 

It’s therefore important for businesses to defend themselves, and make use of a reputable platform for data security across enterprise, cloud, and SaaS. Knowing the posture of the data you’re protecting and any gaps in your security will aid in managing regulatory requirements and achieving higher operational resilience. Because everyone that has been in this industry for a while knows you can’t rest on your laurels.

 

---

 

Richard Cassidy is EMEA Field CISO at Rubrik

 

Main image courtesy of iStockPhoto.com