The Federation of European Risk Management Associations (FERMA) has recently urged European institutions to simplify cyber incident reporting requirements, emphasizing the need to consider the insurance implications of cyber legislation. This request follows the unveiling of the Cyber Reporting Stack report, crafted in cooperation with WTW, which provides essential guidance for risk managers as they navigate the complex landscape of cyber policy and reporting obligations.
The Cyber Reporting Stack report details current and anticipated regulations, including prominent frameworks such as the General Data Protection Regulation (GDPR), the Network and Information Security (NIS) 2 Directive, the Digital Operational Resilience Act (DORA), and the Cyber Resilience Act (CRA). Each of these regulations imposes unique reporting requirements that can overwhelm organizations if not efficiently managed.
Charlotte Hedemark, President of FERMA, pointed out the increasing burden placed on companies due to the multitude of cyber reporting obligations. She expressed that a streamlined, consistent set of requirements for reporting cyber incidents is essential for effective compliance. The report advocates for the establishment of a ‘single point of entry’ for cyber incident notifications, suggesting that EU member states should unify their processes and participant involvement to enhance efficiency.
Philippe Cotelle, Chair of FERMA’s Digital Committee, articulated a poignant observation: the current regulatory landscape does not adequately specify necessary risk management measures nor does it fully account for the related insurance implications. This gap in the framework not only complicates reporting for organizations but also raises questions regarding liability and support in the aftermath of a cyber incident.
One relevant example can be seen in the GDPR, which requires organizations to notify the relevant supervisory authority about a data breach within 72 hours of becoming aware of it. The NIS 2 Directive and DORA further intensify the reporting requirements. For instance, under the NIS 2 Directive, essential and important entities are required to report incidents that significantly impact the continuity of their services. This complexity can create confusion and cause organizations to struggle with compliance, especially smaller businesses that may lack dedicated resources for managing such obligations.
Addressing this confusion is paramount. Inconsistent regulations and reporting methods across different member states can impede effective communication and timely response during cyber incidents. By advocating for a unified reporting system, FERMA aims to alleviate the regulatory burden on organizations and enhance the effectiveness of cyber incident responses.
Another critical consideration is the connection between cyber policies and insurance practices. Insurers often require detailed incident reporting for claims processing. However, the varied requirements across jurisdictions can lead to inconsistencies that complicate this process. Insurance providers might find themselves grappling with numerous, divergent requirements that delay claim approvals, impacting businesses that are already in distress following a cyber incident.
Establishing clarity in reporting obligations will not only simpler compliance for businesses but will also foster a more conducive environment for insurers and risk managers to collaborate effectively in managing cyber risks. Additionally, the proposed single point of entry could function as a central hub for information sharing, enabling timely notifications and responses that can mitigate the damage from cyber incidents.
In conclusion, the pressing need for simplified cyber reporting obligations in Europe cannot be overstated. The recommendation made by FERMA represents a significant step toward supporting organizations in their cybersecurity efforts while also ensuring that regulatory frameworks consider the realities of risk management and insurance. As the landscape of cybersecurity continues to grow more complex, European institutions have a vital role in creating regulations that foster clarity, efficiency, and resilience.
