5 steps to integrating business continuity and cyber resilience

August 2018 Cyber Security, Security Services & Risk Management

Business’s increasing dependence on digital platforms and data has generated significant efficiencies – but has also spawned a well-resourced cybercrime industry. It is thus imperative that cyber resilience is integrated into organisations’ business continuity management plans, says Michael Davies, CEO of ContinuitySA.

Michael Davies.
Michael Davies.

“Cyber breaches are headline news, and their consequences – financial, reputational and personal – are huge. No wonder then that cyberattacks (and their non-disclosure) are rated the No. 1 industry risk as regards impact in the Institute of Risk Management South Africa’s Risk Report 2018,” says Davies. “The ability to protect one’s IT systems and recover from any breach, which we call cyber resilience, is thus critical.

“Cyber resilience is not just about technology, it must also cover the company’s people and processes. Cyber resilience thus cannot exist in isolation, and must be integrated into a broader business continuity plan.”

Davies adds that cyber breaches are increasing in frequency and severity, prompting many industry commentators to argue that companies should assume they will be breached at some point. There were 1293 recorded data breaches in 2017, with many going unreported, which was up by 21 percent from 2016.[1] The global costs of cybercrime will reach $6 trillion a year by 2021, double the $3 trillion they cost in 2016.[2] Significantly, the average cost of a data breach is $3.62 million, up by 17 percent since 2013.[3]

In parallel with the growing risk posed by business’s reliance on digital platforms and the data they hold, system downtime and/ or data loss are becoming less and less acceptable. Consumers, business partners and regulators are all increasingly intolerant of business interruption. Reputational damage and lost sales are only half of the problem; a growing number of regulations (for example, the Protection of Personal Information Act in South Africa and the European Union’s General Data Protection Regulation) impose penalties for data breaches.

However, while cybersecurity has become top-of-mind for CIOs, confidence levels are low. Research by the New York Stock Exchange shows that only 4 percent of directors were very confident that their companies were secured against cyberattack, whereas 66 percent were less than confident.[4] Nonetheless, governance codes like King IV and, increasingly, legislation, are putting the responsibility for data and IT governance squarely on the shoulders of the board.

“Integrating cyber resilience into the broader business continuity strategy and plan will maximise the company’s ability not only to protect against a data breach, but to detect when one has occurred and recover from it,” says Davies. “Follow five critical steps to achieve this integration.”

1. Align IT and business to a cyber-resilience strategy. A critical element will be to use a common language to enable this alignment. Neither party will be effective working solo.

2. Get top management buy-in. As with most business initiatives, having executive sponsorship is critical to gain traction – and receive budget. Given the importance of business continuity as a whole, and cyber resilience, this sponsorship should be at board level.

3. Get the balance between risk appetite and resilience right. There is no one-size-fits-all approach. Companies must take the time to understand their particular threat landscape, and their risk appetite. Mitigating risk costs money.

4. Develop a comprehensive cyber strategy incorporating people, processes and technology. As with business continuity, a multi-pronged approach is required. Everybody in the company, and every process, uses technology, so all must be involved.

5. Create a holistic resilience culture of protect, detect, respond and recover. Protection is vital but, as noted above, is unlikely to be fool proof, so the ability to detect that a breach has even occurred is vital in order to trigger a suitable response.

“Recovering from a successful cyberattack is never going to be a purely technological issue – the people and process angles have to be there, not to forget the key role of crisis communication with stakeholders, employees and the public where appropriate,” Davies concludes. “That’s why cyber resilience must form part of business continuity management: everything has to work together.”

[1] Identity Theft Resource Centre, 2017 Data Breach Report.

[2] IDG, Cybersecurity Business Report, 2016.

[3] Ponemon, 2017.Cost of data breach study, available at https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?htmlfid=sel0313owwen

[4] NYSE Governance Series. Cybersecurity in the boardroom (2015), available at https://www.nyse.com/publicdocs/veracode_survey_report.pdf. https://www.irmsa.org.za/page/2018_risk_report

For more information contact ContinuitySA, +27 11 554 8050, cindy.bodenstein@continuitysa.co.za, www.continuitysa.co.za.


Credit(s)




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Keeping our changing environment secure
August 2019 , Editor's Choice, Security Services & Risk Management
For a crime to take place there needs to be a victim and a criminal who sees an opportunity. For a cybercrime to take place we need the same set of circumstances.

Read more...
The importance of real security risk assessments
August 2019, Sentinel Risk Management , Editor's Choice, Security Services & Risk Management, Residential Estate (Industry)
Andy Lawler, MD, Sentinel Risk Management, says a security risk assessment is an onerous task, but is not something estates can consider optional or a luxury item anymore.

Read more...
Risk assessment or product placement?
August 2019, Technews Publishing, Alwinco, SMC - Security Management Consultants , Editor's Choice, Security Services & Risk Management, Residential Estate (Industry)
Hi-tech security solutions asked a couple of experts to provide estate managers and security managers with some insights into what a ‘real’ risk assessment includes.

Read more...
Residential security – caveat emptor
August 2019, Stafix , Integrated Solutions, Security Services & Risk Management
When it comes to improving your property’s security, make sure you take all the options into account as you build a layered approach to keeping people safe and assets secured.

Read more...
Ensuring your electric fence is compliant
August 2019, Stafix , Perimeter Security, Alarms & Intruder Detection, Security Services & Risk Management
A challenge facing both existing and potentially new perimeter electric fence installations is how to economically meet the legal requirements required in the SANS 10222-3:2016 standards document.

Read more...
Addressing risks by means of access control layout and design
August 2019 , Access Control & Identity Management, Security Services & Risk Management
In order to develop a suitable, practical and appropriate security system for any organisation, it is essential to first develop a master security and life safety plan strategy.

Read more...
Inundated with cyberattacks from all directions
August 2019 , Editor's Choice, Cyber Security, Security Services & Risk Management
IT managers are inundated with cyberattacks coming from all directions and are struggling to keep up due to a lack of security expertise, budget and up-to-date technology.

Read more...
Under cyberattack
August 2019, Kaspersky Lab , Cyber Security, Residential Estate (Industry)
Cybersecurity is not something one usually associates with residential estates, but the threats from cybercriminals apply equally to estates as they do to businesses and the individual homeowner.

Read more...
Addressing risks in the healthcare sector
August 2019, Secnovate, Technews Publishing, ZKTeco , Healthcare (Industry), Security Services & Risk Management
The healthcare sector poses unique challenges and risks. Hospitals, for example, need to have a more-or-less ‘open door’ policy when it comes to people entering the premises and the main reception area.

Read more...
Patient critical – healthcare’s cybersecurity pulse
August 2019, Wolfpack Information Risk , News, Cyber Security, Healthcare (Industry)
The healthcare industry has become one of the leading cybersecurity attack vectors worldwide for several reasons.

Read more...