We believe that before choosing a cyber security framework, a business should first focus its efforts to understand their strategic business objectives so security can enable achieving them but also take in consideration the legal, contractual and regulatory requirements.   

A common mistake that our cybersecurity consultants often encounter is that businesses through money where is not needed, and thefore businesses should first focus on understanding the key assets they want to protect, followed by identifying cyber security threats that the business is exposed to, assets in scope and continuously identify vulnerabilities among those assets. It is then paramount to identify your cyber security risks and the controls that you need to implement to mitigate risks – that’s when a cybersecurity framework that fits your business needs comes handy. 

There are a number of internationally recognized cybersecurity frameworks such as NIST CSF, ISO27001, SOC2 Type II, PCI DSS, CSA and many others. The most important factor is that a business takes one of these and make it relevant to them.  

Adhering to a cybersecurity framework is good but there is no one size fits all. Many of the frameworks don’t cover the most important factor– to focus on the unique threats to a business.  

Cyber security can be improved by addressing the basics of security and focusing on your technology, people and processes.  You’d be surprised how many businesses still haven’t put in place basic cyber security fundamentals; things like: 

• Using multi-factor authentication 
• Having in place advanced endpoint protection and response 

• Patch early, patch often 
• Harden your systems by changing default username and passwords and removing weak protocols – especially those exposed to the internet 
• Having good network security 
• Backup regularly and keep a recent backup copy off-line and off-site 
• Providing cyber security awareness training 

• Having cyber security policies and processes 
• Use strong passwords  

Every business who has a digital presence needs to be aware of the importance of cyber security.  

Often attackers target SMEs with little or no protection.  Their motivations may not be financial, they might just do it for a laugh – posting inappropriate content on your homepage or redirecting clients to a pornographic site. Only you can decide the impact this would have on the reputation of your business. 

But these days, cybercriminals are very financially motivated as there is money to be made out of your data by auctioning it on the dark web to the highest bidder. 

So why is cybersecurity important to businesses? Because the consequences of ignoring it could be catastrophic. If you process personal information, a data breach could violate New Zealand privacy laws and lose the trust of your customers. You could be faced with reputational damage or suffer considerable financial loss and business disruption if you fall victim to a phishing attack or ransomware.  Very few companies come out of a cyber attack unscathed – even if it’s contained, you’ve lost time and productivity by trying to sort the problem out. If you want to stay in business, cybersecurity needs to be a part of your business and sponsored at the top level.