AROUND half of companies in the East of England do not have a strategy in place to mitigate the risk of cyber crime or business continuity plans to execute in the event of an attack, according to a new poll from the Northampton office of financial and business advisers Grant Thornton.
The survey, conducted at a series of cyber security awareness events held by the firm across the region, revealed that although two thirds of attending companies had been targeted by cyber crime, only 53 per cent had developed strategies against attacks and just 50 per cent had business continuity plans should they fall victim to a breach, leaving them highly vulnerable.
According to the 2019 Cyber Security Breaches Survey, 60 per cent of mid-sized businesses (50 to 249 employees) and 61 per cent of large businesses (more than 250 people) in the UK identified a cyber breach or attack in the last 12 months, although small businesses (10 to 49 employees are not immune to the threat. However, the National Audit Office estimates 80 per cent of all attacks could potentially be avoided by exercising good cyber hygiene.
Grant Thornton says it is imperative for local organisations to take the threat of cyber crime seriously and having all the protections and systems in place to prevent a breach or mitigate any fallout from an attack is crucial for business longevity.
James Arthur, head of cyber consulting at Grant Thornton, said: “Cyber security isn’t just a technical problem, it’s a risk that should be managed in a similar way to all other business risks.
“The continuous development of new methods to connect and share information increases the chance of a security threat. Our poll results clearly show a cyber attack is not just something that ‘happens to other businesses’; it’s a real issue that can affect us all and cause severe damage to an organisation’s immediate business capability and reputation.
“Cyber incidents are unpredictable and unforgiving and while it may not be possible to completely prevent risk, having robust procedures in place will greatly limit the chances of an attack and reduce the impact should a breach occur.”
Grant Thornton’s survey also found just 40 per cent of businesses in the East of England feel their insurance provides adequate protection against cyber crime. The Cabinet Office estimates the total annual cost of cyber crime to UK businesses as £21bn and whilst not all local organisations operate on a multi-million large scale, the financial implications of an attack, irrespective of the size of a business, should not be underestimated.
James Arthur added: “The consequences of an attack can be severe and it’s not just the loss of trade and cost to a business’ reputation that has to be counted. Organisations can now face significant fines under the General Data Protection Regulations (GDPR) if they did not have the correct processes in place or failed to report the breach within 72 hours.
“Liability insurance is designed to support businesses in the event of a data breach or attack. Policies may include protection against cyber extortion, the cost of investigating a breach and support to mitigate reputational damage. However, it is worth checking as terms can differ between insurers. It should also be noted that many claims end up being disputed so procedure and correct recording and reporting of incidents is vital.
“Finally, it’s important to remember that people remain companies’ biggest weakness. All employees, including senior management, need to be educated and remain vigilant against the risks to create a security conscious culture throughout the organisation.”
Grant Thornton’s cyber consulting team recommends all businesses employ robust assurance procedures. This includes assessing how effective current systems are; identifying key risks; reviewing third party risk management arrangements; complying with industry, regulatory and legal standards and continually reviewing and updating privacy and security strategies to ensure they remain effective.
Find out more at www.grantthornton.co.uk
