Building digital trust

Building trust is a journey worth taking

If the lifeblood of the digital economy is data, its heart is digital trust - the level of confidence in people, processes, and technology to build a secure digital world. Companies, regulators, and consumers need fresh mechanisms to build confidence as they address emerging challenges in business, risk management, and compliance. However, our Digital Trust Insights Survey shows that many companies still pay insufficient attention to their protection against cyber attacks.

'In the current digital world, in which organizations increasingly use technology and we are increasingly connected with each other, companies have the responsibility to minimize the digital risks,' says Gerwin Naber, leader of PwC's cybersecurity practice. 'Our research shows, however, that only half of the medium-sized and large companies in important sectors as financial services, health care, consumer markets and technology, media and telecom are increasing their resilience to cyber attacks. And less than half of that group is satisfied with the way their company has tested its defense against hackers.'

In the tradition of its predecessor, The Global State of Information Security® Survey, PwC’s inaugural Digital Trust Insights survey draws on data from 3,000 business leaders in 81 territories. We have uncovered ten major opportunities for improvement around people, processes and technology and we have actionable advice to get you there. Digital trust is a journey - make certain you have the right people, the right tools, and the agility to reach the top.

Improve communications and engagement with the board of directors: Most respondents responsible for communicating with the board on cyber and privacy risks say that their company has provided the board with strategies for cybersecurity (80%) and privacy (83%), Many of these same businesses, however, may have doubts or concerns around their internal reporting on cybersecurity and privacy metrics. Only 27% of respondents say they are very comfortable that the board is receiving adequate reporting on metrics for cyber and privacy risk management.

Follow-up with process strategies that continue to build trust

Tie security to business goals: As corporate leaders aggressively adopt technology-driven business models, cybersecurity programs are increasingly misaligned with the business. Only 23% say they plan to invest over the next year in aligning business objectives with information security strategy.

Build lasting trust around data: As the amount of data in the world soars, more companies could be at risk of crossing ethical red lines as they pursue new ways to monetize it. Among businesses worth more than $100 million, only about half say they are making large investments in data governance, in creating transparency in the use and storage of data and toward increasing the control individuals have over their data.

Boost cyber resilience: Cyber resilience includes the agility of both defense and recovery capabilities. Resilient systems help companies to sustain operations when possible amid cyberattacks, and to rapidly recover in the event of disruption. Only about half of medium and large businesses in key sectors say they are building resilience to cyberattacks and other disruptive events to a large extent. And fewer than half of them say they are very comfortable their company has adequately tested its resistance to cyberattacks.

Know thy enemies: Cyber threat worries vary by industry and company size. Over the last year, concerns about state-sponsored hackers increased most in financial services (33%), while anxiety about cybercriminals spiked in consumer markets (50%) and the biggest rise in unease about industrial espionage was in the TMT sector (51%), according to respondents from medium and large businesses. Only 31% of respondents worldwide, however, say they are very comfortable their company has identified those parties who might attack its digital assets.

Be proactive in compliance: Respondents say the top digital compliance and ethics challenges worldwide include staying aware of the latest regulatory developments (41%); complying with current regulations (37%); and preparing for future regulations (34%). Brazil's data protection law is a recent example of new legislation. Perhaps the most well known example is the European Union’s General Data Protection Regulation (GDPR), which went into effect in May 2018. Fewer than half of companies worth more than $100 million say they are fully ready to comply with GDPR.