Business’s increasing dependence on digital platforms and data has generated significant efficiencies—but has also spawned a well-resourced cyber-crime industry. It is thus imperative that cyber resilience is integrated into organisations’ business continuity management plans.
Cyber breaches are headline news, and their consequences—financial, reputational and personal —are huge. Cyber resilience is the ability to protect one’s IT systems, and recover from any breach, which is critical. Cyber resilience is not just about technology, it must also cover the company’s people and processes. Cyber resilience thus cannot exist in isolation and must be integrated into the broader business continuity plan.
Cyber breaches are increasing in frequency and severity, prompting many industry commentators to argue that companies should assume they will be breached at some point. In parallel with the growing risk posed by business’s reliance on digital platforms and the data they hold, system downtime and/ or data loss are becoming less and less acceptable. Consumers, business partners and regulators are all increasingly intolerant of business interruption. Reputational damage and lost sales are only half of the problem; a growing number of regulations (for example, the Protection of Personal Information Act in South Africa and the European Union’s General Data Protection Regulation) impose penalties for data breaches.
However, while cyber security has become top-of-mind for CIOs, confidence levels are low. Directors remain uncertain that their companies are secured against cyber-attack, due to the complexity of IT systems and connectivity with external systems such as the internet. Nonetheless, governance codes like King IV and, increasingly, legislation, are putting the responsibility for data and IT governance squarely on the shoulders of the board.
Integrating cyber resilience into the broader business continuity strategy and plan will maximise the company’s ability not only to protect against a data breach, but to detect when one has occurred and recover from it.
Follow five critical steps to achieve this integration:
landscape, and their risk appetite. Mitigating risk costs money.
