The European Union-wide General Data Protection Regulation (GDPR) goes into effect in May, including in the UK despite the Brexit vote of 2016. Meanwhile lawmakers in the United States are proposing stricter data breach law. With pressure on companies to protect data and improve notification procedures in the event of a data breach, a cyber security firm surveyed 406 cybersecurity people to see how prepared organisations are feeling ahead of the GDPR deadline.
Findings from the study revealed that just over three quarters (77 percent) of companies subject to GDPR could meet the 72 hour notification window, with 24 percent claiming they could notify customers of a data breach within 24 hours. In addition, when asked how prepared their organization was to notify customers in the event of a data breach, less than a fifth (18 percent) said that they were fully prepared with a process in place. The majority (73 percent) said they were ‘somewhat prepared’ and would have to figure things out ‘on the fly’.
Tim Erlin, vice president of product management and strategy at Tripwire, said: “When it comes to cybersecurity, it’s short-sighted to figure things out ‘on the fly,’. The majority of data breaches and security incidents can be avoided by following basic security steps and implementing tried and tested foundational controls. With GDPR coming into effect this year, running a business without a fully baked plan is really asking for trouble.”
When asked to characterize their company’s capabilities for knowing where its customer data is stored versus for protecting customer data, respondents were more confident in knowing where the data is. Over a third (35 percent) said their knowledge of where the customer data is stored is ‘excellent’ by comparison to just over a fifth (21 percent) saying the same for their ability to protect customer data. Other findings included: most don’t feel they are fully prepared for any aspect of a security breach. Less than a fifth (18 percent) felt they were fully prepared with a cross functional team in place to work across IT, finance and communications. Nearly three quarters (73 percent) were not fully prepared to protect customers and only a fifth (22 percent) felt prepared to absorb potential financial penalties as a result of a security breach.
Erlin added: “There are plenty of tried and tested frameworks available from governing bodies in the cyber security space that can help organisations who feel like they’re struggling to prepare for a security incident and more specifically, GDPR. If you are an organisation subject to GDPR – and as the rules apply to all companies worldwide that process personal data of European Union (EU) data subjects, that will be the majority of global businesses – you are not alone. Start researching for resources that cater to your needs now to help you prepare, so that you aren’t hit with a big fine come May 2018.”
About the study
Commissioned by Tripwire and carried out by Dimensional Research in November 2017; a total of 406 qualified participants completed the survey. All participants had responsibility for IT security as a significant part of their job and worked at companies with more than 100 employees.
