Governance impact

Data is a crucial resource and asset in many businesses and regulations can be provided to ensure the protection of it. The specifics of these can vary across industries or markets however the EU have three main policies:

UK regulations: provide links to:

• Data Protection Act 2018 – uk implementation of GDPR (current)
• Cyber Resilience Act (upcoming)
• NIS2- Network and Information Systems Directive (revised) (current)
• Cybersecurity and Resilience Act (replacing NIS2 for the UK) (upcoming)
• Cyber Governance Code of Practice (upcoming)
• PECR- Privacy and Electronic Communications Regulations (current)

There are further regulations for specific market sectors such as finance, health, telecoms etc.

The four main sources of data include third-party, reported, derived + functional and firm-owned raw data which must be accurate, reliable and free from bias creating the need for cybersecurity protection. Particularly in the case of personal data as this is sensitive information and commonly protected under the laws above.

As technology evolves the need for regular monitoring and updating of privacy, data management and cybersecurity practices is required to ensure compliance, helping to aid efficiencies and the effectiveness of storing, processing and sharing data both internally and externally of the organisation.

Why governance is important

• Helps build trust amongst customers, employees, stakeholders and investors
• Provides accountability and transparency, boosting your reputation
• Aids in informed decision making processes, innovation and risk management
• Long term sustainability resulting in a more resilient business

We Can Help Your Impact

The National Cyber Security Centre have put together a tool to help you build a cyber action plan:

Get a free cyber action plan

Fundamental building blocks towards good cyber governance starts with Cyber Essentials and could lead to enhanced certification standards such as ISO 27001

How to prevent

• Cybersecurity awareness, literacy and understanding crime tactics
• Password hygiene and MFA or 2FA
• Network, cloud and platform security
• Incident response plans
• Timely updates of your systems and applications
• Monitoring and reporting
• Data back ups
• Sharing information and coordinating responses