Directors are insufficiently involved in cyber security

Digital Trust Insights: establish a better connection between cyber and business

Organisations in the Netherlands are aware of the need for cyber security, but an effective connection between business operations and the reduction of cyber risks is often lacking. ‘To ensure that organisations are better able to withstand the increasing number of hacking attacks, they need to make cyber an integral part of their business operations,’ according to Angeli Hoekstra, partner in cyber security at PwC, in response to the annual PwC Digital Trust Insights survey.

‘With every change in business operations, the question must be asked: what will be the resulting impact on cyber security? Unfortunately, that is still a rarity,’ Hoekstra says.

We surveyed more than 3,600 CEOs and other C-level managers worldwide about their organisation's level of cyber security and the measures they take. In the Netherlands, 46 corporate directors participated. The survey showed that compared with last year, only 30 per cent of Dutch organisations have made progress in aligning their cyber strategy with their business strategy.

Cyber Digital Trust Insights NL 2022

Less focus on cyber security in the Netherlands

A striking feature of the study is that the Netherlands scores less well than the rest of the world in many areas. In addition to the above topics, less progress has been made in the Netherlands, for example, in involving the CEO in cyber security (68% compared with 79% worldwide). Furthermore, the amount of time spent on cyber security during board meetings has increased globally: 39% compared with 30% in the Netherlands.

Concerns about the supply chain

Digital Trust Insights also show that businesses have only limited insight into the measures that parties they work with take when it comes to cyber security. Globally, less than half the respondents (forty percent) indicated that formal reviews give them insight into possible data breaches at third parties. In the Netherlands, this is only 35 percent.

Managing risks relating to the software supply chain scores even lower. Globally, 34 percent of the participating organisations have insights as a result of formal reviews. That is only 20 percent in the Netherlands. According to Angeli Hoekstra, ‘it is vital for organisations to not only ensure that their own cyber security is in order, but also that they are aware of and can manage the cyber risks in their ecosystems.’

Using data to understand cyber risks

The increasing complexity of their business operations is a major challenge for many (75%) directors in making their organisations secure. In order to get a better grip on managing cyber security, Angeli Hoekstra says it is important in the first instance that companies know where most risks lie. ‘Unfortunately, in most organisations worldwide it is still a problem to obtain this insight and in the Netherlands it is an even bigger problem. The effective use of data can provide a better understanding of cyber risks and make it easier to assess where investments in cyber security should be made.’