Businesses to be hit with massive fines if cyber security deemed inadequate

August saw the UK government warn companies that they could face fines of up to £17m - or four percent of annual turnover - if they do not have adequate cyber security measures in place. The proposals were aimed at critical national infrastructure companies, but an IT and communications expert says it serves as a caution to all businesses that neglecting cyber security and leaving the UK open to cyber threats will not be tolerated.

Utility companies, healthcare and transport are some of the key sectors being targeted by the government’s proposals, in a bid to prevent major disruption to these services should a cyberattack strike. They come following the spread of the WannaCry ransomware attack that crippled the National Health Service (NHS) during May this year.

According to corporate and insurance law firm RPC, ransomware is now the most likely cyber-threat to UK businesses. It claims 25 percent of all major cyberattacks involve an attempt to get businesses to pay a ransom to retrieve their data.

Simon Ahearne, managing director of Swansea-based SA1 Solutions, suggests investing in software that makes life difficult for hackers to penetrate a company’s data is only one way to prevent a cyberattack. Investment in awareness training for employees should also be prioritised, so staff know what to look out for, should a threat be presented.

Ahearne commented:

“These proposals come as no surprise as the UK looks to clamp down on the rising cyberattacks we’ve been hit with of late. Businesses need to realise that these fines are a preventative measure. A company could lose significant amounts of money should they fall victim of an attack and that potentially puts the data of others in jeopardy. It’s irresponsible to not have appropriate cyber security measures in place, so a fine should be imposed.

“Fines have also been outlined for lesser offences, such as failing to report an incident or cooperate with the relevant authority. This shows a clear need for staff to be educated about what to do and what not to do to prevent a cyberattack, as well as how to respond if the worst was to happen. Simply opening an email attachment from an unknown sender can send a network into lockdown, but it still happens because employees aren’t informed enough to be vigilant.”

SA1 Solutions specialises in assisting businesses manage their data and networks from security threats, and provides an efficient disaster recovery service to respond promptly to security breaches. The company is a leading managed service provider based in South Wales, offering services to over 200 customers across the UK.

The government’s proposals form part of its plans to implement the Security of Network and Information Systems Directive (NIS Directive). The consultation on the proposals recently came to a close (30 September), with the government due to issue a formal response in coming weeks.