Johannesburg, 19 Oct 2012
"When it comes to a data breach or loss of some kind, it's not if, but when," says Ilze Dewing, Business Development Director at endpoint data backup and recovery solutions specialist, Cibecs.
"Recommendations in South Africa's King III report, stipulations in our Companies Act and new incoming legislation such as the Protection of Personal Information Bill (PPI) and the Protection of State Information Bill, places responsibility for the security of sensitive data at the feet of an organisation's board. Neglect to do so can, and will, have a negative impact on individual board members and their organisations alike."
Statistics tell an (alarming) story
Research conducted by Cibecs and IDG Connect in the 2012 Data Loss Survey indicate that, by and large, South African organisations have an alarmingly blas'e attitude towards the security of their business-critical data, with nearly 50% of respondents still relying on users to take responsibility for company data.
It comes as no surprise then that, of the companies that rely on their users for the security of organisational data, 94% have experienced data-related problems as users fail to comply with their company's data backup policy.
"The problem is one of buy-in from board members into the critical need to secure company data," says Dewing. "The 2011 State of the Endpoint Survey (conducted by the Ponemon Institute) revealed that nearly 50% of IT technology decision-makers couldn't solve their security problems because, they felt, they had no buy-in from their CEO and CFO."
Paradigm shift required
This situation will have to change, and rapidly so, if companies are to avoid hefty penalties and the other costs related to data loss or data security breaches.
In addition, a recent Deloitte & Touche survey revealed that few South African companies have achieved compliance - and only 50% of the companies surveyed had commenced any steps towards compliance.
"Even more worrying is the large percentage of companies that do not even understand the impact of the law and the compliance requirements," says Dean Chivers, a director in Deloitte & Touche's legal department. "Any medium or large entity, which has not commenced compliance activities by the end of this year, is very unlikely to comply timeously."
Recognise, minimise risk at boardroom level
Considering the kind of data that is at risk and the negative impact the loss of that data will have on a business or enterprise, the situation is nothing short of alarming.
"Consider for a second the kind of data that drives businesses and organisations, "says Dewing. "Everything an organisation is built on is at risk and it's the board's fiduciary duty to make sure that that risk is minimised - and that mechanisms exist to recover swiftly should defences be breached."
Share