Many organisations in Europe are still unprepared for the new European Union (EU) security legislation, a report by security firm FireEye has discovered.
A survey of organisations from the UK, France and Germany found a wide lack of readiness for the proposed Network and Information Security (NIS) and General Data Protection Regulation (GDPR) legislation.
The GDPR is set to be finalised in early 2015, with compliance becoming mandatory in 2017. The NIS directive – set to be implemented this year – will impose new security and incident reporting requirements on a broader range of private sector companies.
The report also gauged how organisations perceive the scale and importance of the legislation and predicted how organisations are most likely to prepare themselves for compliance.
>See also: How to comply with the new EU Data Protection Regulation
Based on responses, it concluded that there is a mixed state of readiness at best, with many not understanding the true extent of the potential impact of the legislation.
“The past year has shown that breaches are inevitable as hackers continue to evade security, and the EU directives are an important step toward addressing these threats,” said Richard Turner, VP EMEA, FireEye. “Organisations need to ensure that they have the capabilities to detected, prevent, analyse and respond to breaches in a timely manner. The EU legislation — both the NIS directive and GDPR — promotes the adoption of capabilities to respond to and report breaches. While this is a positive step, organisations need to look beyond the EU directives and be prepared to launch an appropriate and proportionate response to a threat or breach in order to protect shareholder value.”
Only 39% of respondents indicated that they have all the required measures in place for the NIS directive and less so for GDPR, while one third believed their organisations did not fully understand the impact of the regulations.
More than 60% of the organisations surveyed said they are being provided little or no clear guidance on the legislation, while 62% expected a colleague in their IT department will be tasked with assessing it.
Among the respondents, the top concerns associated with serious data breaches and loss of personal information are potential fines (58%), damage to reputation (57%), and loss of business and revenue (58%).
Almost two thirds (64%) cited additional expenditure on hardware and software as a challenge, with 23% rating this as the single most important barrier to complying with the directives. Other barriers included implementation costs (58%) and policy complexity (56%).
>See also: Half of UK businesses unaware of new EU data laws
“The new EU security and privacy requirements are incredibly important and will greatly increase the security obligations of European organisations,” said Adam Palmer, international government affairs director at FireEye. “We encourage organisations of all sizes to adopt mitigation measures that will manage risk stemming from zero-day exploits and never-seen-before malware as these attacks constitute a majority of advanced attacks in today’s threat environment.
“However, our research does show that organisations are not fully prepared for the implementation of the legislation, and it is critical these organisations begin preparing now to be in compliance and not be caught unprepared.”
