Five steps to integrating business continuity, cyber resilience

Integrating cyber resilience into the broader business continuity strategy will maximise the company's ability to protect against a data breach and detect when one has occurred and recover from it, says Michael Davies, CEO of ContinuitySA.


Johannesburg, 05 Jun 2018
Read time 3min 40sec
Michael Davies, CEO of ContinuitySA.
Michael Davies, CEO of ContinuitySA.

Business's increasing dependence on digital platforms and data has generated significant efficiencies, but has also spawned a well-resourced cyber crime industry. It is thus imperative that cyber resilience is integrated into organisations' business continuity management plans, says Michael Davies, CEO of ContinuitySA.

"Cyber breaches are headline news, and their consequences, financial, reputational and personal, are huge. No wonder then that cyber attacks (and their non-disclosure) are rated the number one industry risk as regards impact in the Institute of Risk Management South Africa's Risk Report 2018," says Davies.

"The ability to protect one's IT systems, and recover from any breach, which we call cyber resilience, is thus critical. Cyber resilience is not just about technology, it must also cover the company's people and processes. Cyber resilience thus cannot exist in isolation, and must be integrated into broader business continuity plan."

Davies adds that cyber breaches are increasing in frequency and severity, prompting many industry commentators to argue that companies should assume they will be breached at some point. There were 1 293 recorded data breaches in 2017, with many going unreported, which was up by 21% from 2016.[1] The global costs of cyber crime will reach $6 trillion a year by 2021, double the $3 trillion they cost in 2016.[2] Significantly, the average cost of a data breach is $3.62 million, up by 17% since 2013.[3]

In parallel with the growing risk posed by business's reliance on digital platforms and the data they hold, system downtime and/or data loss are becoming less and less acceptable. Consumers, business partners and regulators are all increasingly intolerant of business interruption. Reputational damage and lost sales are only half of the problem; a growing number of regulations (for example, the Protection of Personal Information Act in South Africa and the European Union's General Data Protection Regulation) impose penalties for data breaches.

However, while cyber security has become top-of-mind for CIOs, confidence levels are low. Research by the New York Stock Exchange shows only 4% of directors were very confident that their companies were secured against cyber attack, whereas 66% were less than confident.[4] Nonetheless, governance codes like King IV and, increasingly, legislation, are putting the responsibility for data and IT governance squarely on the shoulders of the board.

"Integrating cyber resilience into the broader business continuity strategy and plan will maximise the company's ability not only to protect against a data breach, but to detect when one has occurred and recover from it," says Davies. "Follow five critical steps to achieve this integration."

* Align IT and business to a cyber resilience strategy. A critical element will be to use a common language to enable this alignment. Neither party will be effective working solo.

* Get top management buy-in. As with most business initiatives, having executive sponsorship is critical to gain traction, and receive budget. Given the importance of business continuity as a whole, and cyber resilience, this sponsorship should be at board level.

* Get the balance between risk appetite and resilience right. There is no one-size-fits-all approach. Companies must take the time to understand their particular threat landscape, and their risk appetite. Mitigating risk costs money.

* Develop a comprehensive cyber strategy incorporating people, processes and technology. As with business continuity, a multi-pronged approach is required. Everybody in the company, and every process, uses technology, so all must be involved.

* Create a holistic resilience culture of protect, detect, respond and recover. Protection is vital but, as noted above, is unlikely to be foolproof, so the ability to detect that a breach has even occurred is vital in order to trigger a suitable response.

"Recovering from a successful cyber attack is never going to be a purely technological issue; the people and process angles have to be there, not to forget the key role of crisis communication with stakeholders, employees and the public where appropriate," Davies concludes. "That's why cyber resilience must form part of business continuity management: everything has to work together."

ContinuitySA

ContinuitySA is Africa's leading provider of business continuity management and resilience services to public and private organisations. Delivered by highly skilled experts, its fully managed services include ICT resilience, enterprise risk management, work area recovery and BCM advisory, all designed to enhance business resilience in an age of escalating threat. By helping clients understand their risk profile, and then developing an appropriate risk-mitigation strategy, ContinuitySA provides peace of mind for all stakeholders.

ContinuitySA operates the continent's biggest network of recovery centres, with more than 20 000m2 of space in Gauteng (Midrand and Randburg), the Western Cape (Tyger Valley), in KwaZulu-Natal (Mount Edgecombe) as well in Botswana, Mozambique, Kenya and Mauritius.

ContinuitySA is a Gold Partner of the Business Continuity Institute and was inducted into the prestigious BCI Hall of Fame in 2016.

ContinuitySA. Our business is keeping you in business.

Additional information about ContinuitySA can be found at www.continuitysa.com. Network with ContinuitySA on Google+, LinkedIn, Twitter and Facebook.

[1] Identity Theft Resource Centre, 2017 Data Breach Report
[2] IDG, Cybersecurity Business Report, 2016
[3] Ponemon, 2017 cost of data breach study, available at https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?htmlfid=SEL03130WWEN
[4] NYSE Governance Series. Cyber security in the boardroom (2015), available at https://www.nyse.com/publicdocs/VERACODE_Survey_Report.pdf
https://www.irmsa.org.za/page/2018_Risk_Report

Editorial contacts
Warstreet Marketing Rebecca Warsop (011) 807 9842 rebeccaw@warstreet.co.za
Have your say
Facebook icon
Youtube play icon