Following the rules is not enough

the NIS Directive, has not yet been passed by the European Parliament but is expected to be approved. This directive places stricter security requirements on all companies based in the EU, and mandates that companies in critical sectors, such as energy, finance and healthcare, inform government regulators of significant disruptions and breaches. In what some have seen as a controversial move, the list of critical sectors has been expanded to include technology companies such as Cisco, Google and Amazon.

While these laws are both expected to come into force in two years, it remains to be seen how they will be interpreted and enforced, and the extent to which they will be challenged in court.

However, four things are clear. First, companies must be fluent in the new regulations and ensure compliance. Armed with popular support and public funding, it is safe to assume regulators will actively police and enforce the new laws. Consumers and the media are also tuned in and, along with regulators, will be asking new questions. Breaches are likely to be expensive and highly visible, especially given the new disclosure requirements. The reputational cost will almost certainly be greater than any direct fines.

Second, given their importance, these regulations should not be thought of as solely an IT issue, a compliance issue, or even just a public affairs issue, though the new laws will have repercussions on all three. In the C-suite and boardroom, this is a business-critical issue that leaders should be thinking about and planning for. What steps are in place to ensure employees are learning about and complying with the latest regulations? Who will communicate with regulators? What does it mean for your business if regulators bring formal charges?

Third, training is paramount. Every employee with access to the company’s network poses a risk against which even the most advanced security system cannot guard. Creating a healthy company culture is the best route to security and compliance, and that requires more than handing out copies of  the latest regulations. (See Nailing security for an example of a creative approach.)

Finally, while technology and the regulatory landscape have changed, the principles of good business have not. That means considering the needs of all stakeholders. Companies able to collect and monetize data have a distinct competitive advantage. The more credible a company is at explaining the purpose and benefit of the data it collects, the greater this advantage can be.

A strategy to avoid fines and escape punishment is not enough. Instead, companies need to find ways to use cybersecurity and data collection to separate themselves from the competition.

Peter Lindell is a Partner in Brunswick’s Stockholm office and part of the Cybersecurity and Privacy practice. He also advises on M&A, crisis and corporate communications. Annalisa Barbagallo is a Partner in Brunswick’s Brussels office and advises in the digital and financial services sectors.

Image: Rüstem Gürler, Getty