From: Help Net Security

Many of the world’s largest enterprises are not prepared for the new European Union Directive on cyber security, which states that organizations that do not have suitable IT security in place to protect their digital assets will face extremely heavy fiscal penalties.

The directive, which was adopted in July this year, will require that organizations circulate early warnings of cyber risks and incidents, and that actual security incidents are reported to cyber security authorities. Organisations that suffer a breach because they do not have sufficient IT security in place to protect their digital assets face fines of up to two percent of their annual global turnover.

However, a Ponemon Institute and Tripwire study, which looked at security management of 1320 IT security professionals working in healthcare and pharmaceuticals, financial services, the public sector, retail, industrial, services, technology, software and communications or education and research, revealed that most organisations are under prepared for the Directive and therefore at risk of being fined millions of pounds.

The overall findings from the survey were:

  • 28 percent of organizations do not have a formal risk management strategy applied consistently across the entire enterprise
  • Only 5 percent have a mature risk-based security management program
  • Only 51 percent assess risks
  • Only 58 percent assess vulnerabilities
  • Only 58 percent identify threats.

Read Complete Article