One in 10 leading UK firms lack cyber response plan, finds government survey

A UK government cyber review of its largest 350 listed companies has found that while boards are increasingly aware and involved in managing cyber risks, more needs to be done to keep pace with the growing threat. The UK government’s latest cyber health check of FTSE 350 companies found that one in 10 are operating without a response plan and two-thirds of boards have not received any training to deal with a cyber attack. The UK government’s latest poll of FTSE board members tracks changes in approach to cyber risk since the same survey was carried out last year. The findings show that companies have increased awareness of cyber threats, with 54% naming cyber as a top risk to their business against 49% in the previous survey. The survey also finds that 53% of boards now set their companies’ approach to cyber risks compared with 33% last year. Just 13% of FTSE 350 companies now say that cyber risk is only considered a low or operational risk for their boards. Some 57% of boards were found to clearly understand the impact of lost data assets, up from 49% last year, while 31% said they receive comprehensive management information on cyber risk. The report also found that, for the first time, more boards review the security of customer data (50%) than those that do not (46%). “Decisions about cyber are increasingly being taken at the board level, which reflects a significant, positive culture shift amongst FTSE 350s,” said UK Minister of State for Digital, Matt Hancock. But he added that businesses have much more to do to fully address today’s cyber threats. “We have world leading businesses and a thriving charity sector but recent cyber attacks have shown the devastating effects of not getting our approach to cyber security right. “These new reports show we have a long way to go until all our organisations are adopting best practice and I urge all senior executives to work with the National Cyber Security Centre and take up the government’s advice and training,” Mr Hancock said. Separate UK government research finds that charities are as susceptible to cyber attacks as business. Staff at charities are often ill-informed about cyber risk and those responsible for cyber security often rely on outsourced IT providers to deal with cyber threats, the research suggests. Mr Hancock said charities need to improve cyber defences to better protect sensitive data. He explained that the UK government is working with the Charity Commission and the National Cyber Security Centre (NCSC) to develop a tailored programme to help charities manage the cyber threat. Helen Stephenson, chief executive at the Charity Commission for England and Wales, said: “Charities have lots of competing priorities but the potential damage of a cyber attack is too serious to ignore. It can result in the loss of funds or sensitive data, affect a charity’s ability to help those in need, and damage its precious reputation. Charities need to do more to educate their staff about this threat and ensure they dedicate enough time and resources to improving cyber security.” The report also found that only 6% of businesses are completely ready for the new General Data Protection Regulation (GDPR), which comes into force in May next year, although 97% of FTSE 350 companies are aware of the new rules. The UK government is preparing to introduce its new Data Protection Bill to Parliament to implement the GDPR rules. The UK government launched a five-year National Cyber Security Strategy last November with an investment of £1.9bn. Earlier this week it unveiled proposals aimed at helping major UK industries improve their resilience to cyber threats. Alex Dewdney, NCSC director for engagement, said: “The NCSC is committed to making the UK the safest place in the world to live and do business online. We know that we can’t do this alone – everyone has a part to play. That’s why we’re committed to providing organisations with expert advice through our website and direct engagement.”

One in 10 leading UK firms lack cyber response plan, finds government survey

Want to read this article?

Read Next

International SOS warns of ‘burnout epidemic’

Strebel to replace Gonzalez as head of Swiss Re China

Risk managers want software providers to integrate more AI tools

Court says German government must tighten up climate protection

Premium increases continue to slow down in US commercial P&C market

International SOS warns of ‘burnout epidemic’

Strebel to replace Gonzalez as head of Swiss Re China

Risk managers want software providers to integrate more AI tools

Court says German government must tighten up climate protection

Premium increases continue to slow down in US commercial P&C market

Want to read this article?

Read Next

International SOS warns of ‘burnout epidemic’

Strebel to replace Gonzalez as head of Swiss Re China

Risk managers want software providers to integrate more AI tools

Court says German government must tighten up climate protection

Premium increases continue to slow down in US commercial P&C market

Related Articles