Cybersecurity in Critical Sectors. We may grumble about new rules, but the numbers don't lie!
KPN’s latest study once again makes it clear where the priorities lie for large organizations in critical sectors. Complying with stricter laws and regulations such as NIS2, DORA, and eIDAS is at the top of the list. And honestly, that’s not a luxury—it’s a necessity.
We often complain when Europe introduces new rules, but the reality is that they aren't coming too soon—they're actually coming too late!
You can't just brush them off!
The study is based on a survey of 250 IT and security professionals in the energy, healthcare, government, and financial services sectors. These are the people who see firsthand where things go wrong on a daily basis. Their perspective differs significantly from that of executives. They observe that:
- There is a lack of governance
- Security monitoring is inadequate
- crisis planning is not adequately organized
Cybersecurity stands or falls on ownership and clear decision-making. And that is precisely where the problem lies. Without accountability, risks remain unaddressed and incidents are resolved on an ad hoc basis.
What stands out
- Only 16 percent have a security roadmap at the executive level
- Only 23 percent have mature supply chain security
- 9 percent do not have an overview of their suppliers
- Only 67 percent are prepared for a crisis
- Only 28 percent exercise regularly
These are alarming figures. They show that cybersecurity in critical sectors is not up to standard—and this at a time when these organizations will soon have to comply with NIS2.
I really understand that
Cybersecurity is not a topic you can just touch on during a management team meeting. It requires insight, monitoring, strategy, governance, and mature processes. It’s understandable that board members struggle with this. But not understanding it does not absolve anyone of responsibility. NIS2 requires demonstrable ownership at the board level.
That is why expertise is not a luxury. It is a prerequisite
Precisely because the subject is complex, external expertise is essential. With CISO as a Service, we help organizations to:
- to establish effective governance at the executive level
- developing comprehensive security roadmaps
- to provide insight into supply chain risks
- Ensure that crisis management is institutionalized
- to comply with NIS2 and DORA
Not as a paper tiger, but as a practical solution. As a partner that provides structure, keeps you on your toes, and helps you comply with laws and regulations. But above all, to become truly cyber-resilient.
Source:KPN Research