Many businesses still think of cyber security as an IT function - it’s one of the most enduring myths we face in the industry. This is bad news. Cyber security is not just an IT problem: it is a business problem. Cyber security is risk, and risk is a business issue. Cyber is so much more than a collection of IT controls, yet it’s an uphill battle to get it seen as anything else.

Despite the GDPR routinely (and wrongly) being seen as an encumbrance, many of its requirements make sense for sound business and management reasons. For example, the requirement to maintain Records of Processing Activities (RoPA) under Article 30 can reduce time needed from business analysts when scoping projects. Data Protection Impact Assessments (DPIAs), reduce time misspent on projects which are not appropriate, legally viable, or necessary.

Ultimately, you’ll reduce the risk of data breaches over time when you implement and maintain an effective information security management system.

The business risk of a cyber attack is never going away, as cyber criminals continue to develop more innovative ways to access your data. At the same time, organisations have increasing compliance burdens placed on them, such as ISO 27001, Cyber Essentials, and ad hoc information security requirements. This means businesses are under more pressure than ever to set a strong security strategy and, crucially, stick to it.