Wall Street Journal survey on hacking
Major concerns among compliance professionals:
- Regulatory scrutiny and enforcement: 78%
- Digitization of business: 71%
Recent high-profile cyberattacks:
- September: MGM Resorts International shut down systems after a cyberattack
- February: UnitedHealth Group’s Change Healthcare unit hit by ransomware
Increased regulatory pressure:
- SEC requires cyberattack disclosures within four business days if material impact is determined (starting in December)
- CISA draft rules: report significant cyberattacks within 72 hours and ransom payments within 24 hours (published in March)
Diversity and inclusion as a risk:
- Roughly one-third of companies view it as an increased risk compared to the previous year
- Some companies are retreating from publicly touting diversity, equity, and inclusion (DEI) initiatives due to legal and political threats
- Abandonment of practices like numerical targets and unconscious bias training
Compliance department challenges:
- Nearly half have basic or novice cybersecurity expertise
- Only 8% consider themselves experts
Staffing and skill challenges in cyber compliance:
- Insufficient head count: 35%
- Keeping up with regulatory changes: 31%
- Lack of required skills: 23%
Skill-building in cybersecurity compliance:
- 70% needed to gain knowledge in cybersecurity over the past year
- Regulatory scrutiny and enforcement knowledge required: 67%
Effectiveness of cybersecurity compliance programs:
- At least somewhat effective: 90%
- Very ineffective: 2%