10 Disturbing Cybersecurity Compliance Statistics That Help Drive This Point Home<\/h2>\n\n\n\n
When you don\u2019t have a cybersecurity compliance program or (at the very least) policies in place, you risk things going sideways quickly for you and your customers. Compliance with cybersecurity and data privacy regulations helps keep your organization, data, and customers secure against data breaches and other cybersecurity issues. However, it also has other direct and indirect benefits as well:<\/p>\n\n\n\n
- \n
- Shows customers and other stakeholders that the security of their data is a priority for your business.<\/li>\n\n\n\n
- Helps you avoid costly noncompliance fines and penalties that can result from noncompliance with regional and industry regulations.<\/li>\n\n\n\n
- Protects your organization\u2019s brand and reputation against harm that results from data breaches.<\/li>\n<\/ul>\n\n\n\n
Compliance relates to protecting and securing your data that\u2019s both on prem and in the cloud. And considering that Flexera reports<\/a> that 99% of organizations use either a public or private cloud, it\u2019s critical that you understand how to remain compliant with the regulations that help you keep these resources secure.<\/p>\n\n\n\n
With all of this in mind, let\u2019s consider some relevant industry data (i.e., cybersecurity compliance statistics) that shows exactly what we mean by all of this.<\/p>\n\n\n\n
1. 93% of Employees Are Overly Confident About Their Cyber Preparedness<\/strong><\/p>\n\n\n\n
First on our list of cybersecurity compliance statistics is research from IBM and Morning Consult<\/a>. Their data shows that more than nine in 10 respondents who work from home (WFH) are more confident than they are prepared when it comes to securing sensitive data. Although they\u2019re certain they can protect personally identifiable information (PII), they often lack the tools and training that help to make it possible.<\/p>\n\n\n\n
While feeling confident is important, there needs to be a reason for that self-assuredness. If you feel confident when you have no idea what you\u2019re doing<\/em>, then you\u2019re likely going to find yourself in hot water very quickly. It\u2019s kind of like trying to bake a triple-layer cake when you\u2019re new to baking: If you don\u2019t have a recipe to follow and don\u2019t know what ingredients or techniques to use, it\u2019s a surefire recipe for disaster.<\/p>\n\n\n\n
2. 50%+ of Employees Aren\u2019t Aware of Their Organization\u2019s New Cybersecurity Policies<\/strong><\/p>\n\n\n\n
Data from the same IBM and Morning Consult study also indicates that the cyber awareness of many employees is lacking. This is because many employees are ignorant about new company policies relating to secure password management, how to handle customer data, and other key data concerns.<\/p>\n\n\n\n
When the COVID-19 panic came into effect, many businesses and organizations found themselves scrambling to implement a WFH environment. But with so many changes occurring simultaneously, businesses found themselves having to create and roll out new cyber security policies. In situations like this, it\u2019s critical to train your employees about new policies and procedures when they initially roll out. You also need to incorporate these policies in regular training sessions to:<\/p>\n\n\n\n
- \n
- Help employees stay informed about existing and new policies,<\/li>\n\n\n\n
- Keep these policies fresh in your employees\u2019 minds so they consider them when engaging in different activities online.<\/li>\n\n\n\n
- Cover your butt by showing that you\u2019re taking the necessary steps to keep employees informed. (A little \u201cCYA\u201d is always good for businesses.)<\/li>\n<\/ul>\n\n\n\n
All it takes is one moment of unawareness to find your organization\u2019s name in the news for all the wrong reasons.<\/p>\n\n\n\n
3. 44% of Companies Require Vendors to Provide Proof of Cybersecurity as Part of Their RFPs<\/strong><\/p>\n\n\n
\n![\"A](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2022\/07\/cybersecurity-requests-for-proposal.png\")
Data source: ACA Compliance Group.<\/figcaption><\/figure>\n<\/div>\n\n\n Over the past several years, companies have increasingly expected more from the vendors that they hire in terms of security (as they should!). This push toward greater cybersecurity accountability and requirements can be seen in the increase in firms that \u201care being asked for proof of cybersecurity as part of RFPs.\u201d This is according to data from a poll conducted at the ACA Compliance Group\u2019s Fall Conference in September 2020 and was published in their report Key Trends and Forces Shaping Risk and Compliance Management in 2021<\/a>.<\/p>\n\n\n\n
Let\u2019s consider an example from the U.S. Department of Defense\u2019s (DoD) Requirements for the Acquisition of Digital Capabilities Guidebook<\/a>: \u201cCybersecurity must be addressed early in acquisition planning and apply across all phases of the acquisition and at each technical layer of the solution.\u201d So, to land a government contract, you need to not only communicate what cybersecurity measures you have in place, but you also need to address their comprehensiveness. The resource also states that cloud cybersecurity requirements should be included in DoD contracts.<\/p>\n\n\n\n
Ideally, as part of that proof, vendors should provide any relevant information relating to cybersecurity compliance.<\/p>\n\n\n\n
4. 45% of Organizations Globally Will Experience Supply Chain Attacks by 2025<\/strong><\/p>\n\n\n\n
Next on our list of cybersecurity compliance statistics is a new prediction data from Garner<\/a>. this data shows that by the time 2025 rolls around, two in five organizations will have fallen prey to software supply chains attacks. This is a three-fold increase from their 2021 data. Supply chain attacks are those that target organizations\u2019 development and build systems to infiltrate their codes with malicious code or software. This way, they can infect and attack the organizations\u2019 customers without anyone knowing what\u2019s occurred.<\/p>\n\n\n\n
We\u2019ve already seen some really ugly instances of software supply chain attacks over the past few years \u2014 two major examples of which include the attack targeting SolarWinds and its customers<\/a> and the attack on Kaseya and its managed service provider (MSP) clients<\/a>.<\/p>\n\n\n\n
In the case of SolarWinds, employees relied on weak passwords that wound up getting published online and cybercriminals used the access to install malware onto the federal government contractor\u2019s development server. When SolarWinds rolled out software updates, the attackers\u2019 software shipped with it, thereby allowing the attackers to infect its customers\u2019 networks and infrastructure.<\/p>\n\n\n\n
As you can imagine, being compliant with industry regulations could have helped prevent this incident from occurring. The National Institute of Standards and Technology (NIST) has recently released some Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations<\/a> that you may find useful. While NIST recommendations are applicable to federal government agencies and related third-party vendors, they still provide practical guidance and useful information that commercial entities can use to secure their cyber infrastructure. <\/p>\n\n\n<\/span>\n\n\n
5. GDPR Noncompliance Fines Hit Nearly $100 Million in First Half of 2022<\/strong><\/p>\n\n\n\n
AtlasVPN reports<\/a> that noncompliance penalties faced increased 92% when comparing data from 1H 2021 and 1H 2022. Their research was based on data from the CMS.Law GDPR Enforcement Tracker<\/a> website, which includes data relating to GDPR fines and penalties imposed by authorities within the European Union.<\/p>\n\n\n\n
Of course, some individual organizations have been slapped with major GDPR fines since the regulation went into effect in 2018. For example, Amazon faced a whopping \u20ac746 million fine<\/a> in August (which the company has decided to appeal) and WhatsApp got hit with a \u20ac225m penalty in September 2021.<\/a> To put that in \u201cAmerican\u201d terms, those amounts were the equivalent of nearly $887 million and $276 million U.S. dollars, respectively, at the time those punishments were handed out. (Of course, this is prior to the Euro value dropping, the value of which is now nearly that of the U.S. dollar for the first time in 20 years.<\/a>)<\/p>\n\n\n\n
Although cybersecurity compliance and data security compliance are technically two separate things, they\u2019re closely related. That\u2019s because many data privacy regulations require stringent cybersecurity measures to help keep sensitive personal data secure. For example, the GDPR is a well-known regulation that requires organizations to implement security measures to help secure data both while at rest and in transit.<\/p>\n\n\n\n
6. 46% of Medical Device Companies Say They\u2019re Compliant With Cybersec Regulations & Standards<\/strong><\/p>\n\n\n
\n![\"Cybersecurity](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2022\/07\/medical-device-security-issues.png\")
Data source: Palo Alto Networks.<\/figcaption><\/figure>\n<\/div>\n\n\n Alright, we’re over half way through our list of cybersecurity compliance statistics. Data from the product security platform Cybellum<\/a> shows information that should be very disconcerting to, well, everyone. According to their 2022 data, more than half of surveyed medical device companies think they\u2019re noncompliant with industry guidelines, standards and regulations. Medical devices span the gamut, covering everything from devices used in hospitals to personal devices implanted within patients\u2019 bodies.<\/p>\n\n\n\n
For example, 2022 data from Palo Alto Networks\u2019 Unit 52 research team<\/a> shows that 75% of the infusion pump devices they studied had known security issues. But what makes matters worse is that more than half (52%) had two known vulnerabilities with \u201ccritical\u201d and \u201chigh\u201d severity scores. Considering that many of these devices have lifespans of eight to 10 years, imagine the issues and risks that can result from relying on insecure legacy devices.<\/p>\n\n\n\n
7. 80% of Medical Device Manufacturers View Device Security as a \u201cNecessary Evil\u201d<\/strong><\/p>\n\n\n\n
Remember when you were a kid and your parents assigned you chores you didn\u2019t want to do? If you were like most kids, it means you likely did the absolute minimum required just to get the job done. There was no pride in it, so you didn\u2019t want to put in extra effort to go above and beyond on the task. The same can be said about some medical device manufacturers. <\/p>\n\n\n\n
Data from the same Cybellum report<\/a> shows than more than three-quarters (78%) of respondents say they only do the minimum to achieve compliance. This is slightly less than those who view regulators imposing device security as a \u201cnecessary evil\u201d of the industry. Basically, it\u2019s something that just has to be done and that\u2019s just the way it is.<\/p>\n\n\n\n
8. More Than 22 Billion Records Were Exposed on 4,145 Publicly Disclosed Breaches in 2021<\/strong><\/p>\n\n\n\n
Oh, boy. This next bit of data from RiskBased Security is a real doozy. Their 2021 Year End Data Breach QuickView Report<\/a> shows that more than 22 billion \u2014 yes, billion with a b<\/em> \u2014 records were exposed in 2021 alone. What makes this number even more disturbing is that it represents just the publicly disclosed breaches. This doesn\u2019t include breaches that have gone unreported or haven\u2019t yet been discovered.<\/p>\n\n\n\n
Unfortunately, there\u2019s really no way to know just how many breaches those unknown incidents represent (for obvious reasons). But these incidents would be far less likely to happen if more businesses strictly adhered to compliance requirements and industry best practices. <\/p>\n\n\n\n
9. 23% of Organizations\u2019 Public Cloud Security Incidents Resulted From Misconfigurations<\/strong><\/p>\n\n\n
\n![\"Cybersecurity](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2022\/07\/public-cloud-security-issues.png\")
Data source: Check Point’s 2022 Cloud Security Report.<\/figcaption><\/figure>\n<\/div>\n\n\n One of the most important aspects of compliance is ensuring that your systems are properly configured to meet standards or regulatory requirements. But research from Check Point\u2019s 2022 Cloud Security Report<\/a> shows that nearly one-quarter of the security incidents they studied in the previous 12 months involving public cloud infrastructure resulted from poor configurations.<\/p>\n\n\n\n
Considering that their research shows more than three-quarters (76%) of organizations use two or more cloud providers, this is particularly startling. If companies have issues configuring one cloud environment, then it\u2019s likely that they\u2019re going to have more issues trying to juggle multiple simultaneously.<\/p>\n\n\n\n
10. 39% of Companies Rank Compliance as One of Their Top Three Day-to-Day Headaches<\/strong><\/p>\n\n\n\n
Let\u2019s continue on with the cloud compliance considerations (yay for alliteration). Last but not least on our list of cybersecurity compliance statistics is one final piece of data from Check Point. The company’s research shows that nearly two-fifths of organizations list compliance as their second biggest challenge, following a lack of qualified personnel (45%) that ranked No. 1. But concerns don\u2019t just stem from achieving compliance; other cloud compliance concerns relate to:<\/p>\n\n\n\n
- \n
- Maintaining compliance,<\/li>\n\n\n\n
- Dealing with audits and risk assessments, and<\/li>\n\n\n\n
- Implementing automation regarding compliance-related activities.<\/li>\n<\/ul>\n\n\n\n
What Types of Data & Cybersecurity Regulations Do You Have to Be Compliant With?<\/h2>\n\n\n\n
The answer to that question depends on a few critical factors, including your organization\u2019s physical location, specific industry, or other important considerations.<\/p>\n\n\n\n
Location-Based Cybersecurity Compliance Regulations You Need to Know<\/h3>\n\n\n\n
Much like the cultures that exist within different geographic areas, data security and privacy regulations also vary from one country or state to the next. Countries and their governments tend to have different interpretations of what \u201ccybersecurity\u201d and \u201cdata security\u201d and \u201cdata privacy\u201d all entail.<\/p>\n\n\n\n
According to the United Nations Conference on Trade and Development (UNCTAD)<\/a>, 156 countries (80%) have enacted some type of cybercrime legislation. Furthermore, of the 194 countries they evaluated:<\/p>\n\n\n\n
- \n
- 80% (158) have e-transaction-related laws<\/a> on the books<\/li>\n\n\n\n
- 59% (115) have consumer protection laws<\/a><\/li>\n\n\n\n
- 71% (137) have data protection and privacy laws<\/a><\/li>\n<\/ul>\n\n\n\n
We\u2019re not throwing together a comprehensive list here because that would take a long time. Instead, we\u2019ll quickly cover a few examples of some of the different cybersecurity compliance regulations that companies and organizations must keep in mind based on their geographic locations:<\/p>\n\n\n\n
- \n
- Data Security Law of the People\u2019s Republic of China<\/strong><\/a> \u2014 This Chinese law relates to many activities regarding data processing and data security of Chinese citizens. Articles 45-48 impose fines that start at the equivalent of just under $15,000 U.S. but span upwards of just under $1.5 million. Violations also can result in companies losing their permits or licenses.<\/li>\n\n\n\n
- General Data Protection Regulation (GDPR)<\/strong><\/a> \u2014 This European Union regulation is one that applies to businesses both in the EU and abroad if overseas companies are handling data of people located in an EU member state. GDPR Article 83.5 says<\/a> that especially severe violations can range up to \u20ac20 million or up to 4% of \u201ctotal worldwide annual turnover of the preceding financial year, whichever is higher.\u201d For less severe violations, these amounts of halved.<\/li>\n\n\n\n
- California Consumer Privacy Act (CCPA)<\/strong><\/a> \u2014 The CCPA is a United States law that protects the security of personal data relating to California state citizens. This can result in fines and penalties ranging from up to $2,500 per unintentional violation to upwards of $7,500 for each intentional violation.<\/li>\n<\/ul>\n\n\n\n
For a look at some location-based cybersecurity regulations, be sure to check out this comprehensive list from the National Conference of State Legislatures (NCSL)<\/a>.<\/p>\n\n\n\n
Industry-Based Cybersecurity Regulations<\/h3>\n\n\n\n
We\u2019re not going to cover all regulations as there are way too many to get into in a single article. We\u2019ll just list some of the major ones:<\/p>\n\n\n\n
- \n
- Gramm-Leach-Bliley Act (GLBA)<\/strong><\/a> \u2014 This law applies to financial industry organizations and institutions in the U.S. Violations of this act. It\u2019s enforced by the Federal Trade Commission (FTC) and can include federal civil and criminal penalties.<\/li>\n\n\n\n
- Health Insurance Portability and Accountability Act (HIPAA)<\/strong><\/a> \u2014 Violations of this healthcare-related law can cost businesses and organizations up to $50,000 per violation or upwards of $1.5 million per year for multiple violations.<\/li>\n\n\n\n
- Payment Card Industry Data Security Standard (PCI DSS)<\/strong><\/a> \u2014 This one is a bit different in that it\u2019s not actually the Payment Card Industry council that\u2019s imposing the penalties. Rather, it\u2019s up to the individual credit card companies (American Express, Discover, MasterCard Visa, etc.) to implement these fines and penalties themselves, which they can do on a monthly basis. These fines can range from $5,000 to upwards of $100,000 per month<\/em>, according to ComplianceGuide.org<\/a>.<\/li>\n<\/ul>\n\n\n\n
- Health Insurance Portability and Accountability Act (HIPAA)<\/strong><\/a> \u2014 Violations of this healthcare-related law can cost businesses and organizations up to $50,000 per violation or upwards of $1.5 million per year for multiple violations.<\/li>\n\n\n\n
- General Data Protection Regulation (GDPR)<\/strong><\/a> \u2014 This European Union regulation is one that applies to businesses both in the EU and abroad if overseas companies are handling data of people located in an EU member state. GDPR Article 83.5 says<\/a> that especially severe violations can range up to \u20ac20 million or up to 4% of \u201ctotal worldwide annual turnover of the preceding financial year, whichever is higher.\u201d For less severe violations, these amounts of halved.<\/li>\n\n\n\n
- 59% (115) have consumer protection laws<\/a><\/li>\n\n\n\n
- 80% (158) have e-transaction-related laws<\/a> on the books<\/li>\n\n\n\n