Preparing for the CRA, DORA, and other regulatory earthquakes Recently, news about emerging cybersecurity regulation has become as routine as the weather report.
In the past year, the UK and EU governments have become increasingly aggressive about mandating specific investments in security posture and reporting due to the number, scale, and seriousness of security incidents and their impact on consumers. The adoption of AI is a regulation driver in itself, as covered here.
It’s important that organizations everywhere understand the potential impact of these new regulations on security investments across the supply chain – not just because of their potential GDPR-scale impact, but because failing to comply will lead to heavy fines, in some cases for entities outside the EU.
Presented in order of implementation date, the following regulations are expected to make significant impacts:
Effective: April 29, 2024 Impact: High for manufacturers
The UK’s PSTI Act, which recently came into effect, was designed to increase the adoption of pre-existing standards for two related issues in the UK’s telecommunications industry: product security and infrastructure resilience. Importantly, the act assigns equal responsibility to importers and distributors for any “compliance failures” in a manufacturer’s products. Among other things, the PSTI Act requires manufacturers to self-attest that a public-facing, clear and transparent security vulnerability reporting mechanism is in place, that receipts of reports are acknowledged, and that status updates are provided free of charge. Penalties can reach £20,000 per day of noncompliance.
Effective: October 17, 2024 Impact: High
An expansion of the original NIS1 Directive, NIS2 will strengthen and streamline security and reporting requirements by mandating a checklist of basic security capabilities, including incident handling, supply chain security, and vulnerability handling and disclosure. Effectively all medium and large-sized companies in critical infrastructure sectors (e.g., banking, transportation, cloud computing, tech, and telecommunications) will be required to assess their adoption of capabilities on the checklist and take appropriate actions. An additional twist is that NIS2 will require individual companies to assess cybersecurity risks across their supply chains, not just inside their own walls. Noncompliance will result in fines of at least €7,000,000 or 1.4% of the total revenue of the preceding fiscal year, whichever is higher—and the fines will be significantly more severe for companies categorized as “essential” providers.
Effective: January 17, 2025
Impact: High for financial services organizations
DORA (for which Bugcrowd was an advisor) seeks to rationalize the patchwork of cybersecurity risk regulations governing the use of information and communication technology (ICT) by financial services entities across EU member countries. DORA was proposed in recognition of the shared risk created by the interconnectedness of companies, markets, and infrastructure in this industry. Notably, DORA will also apply to third-party ICT service providers (e.g., cloud computing platforms, data brokers, and data centers) in the financial services information supply chain and not just to the companies themselves. Among other things, regulated entities are expected to conduct continuous vulnerability assessments of their ICT systems and to document and classify “cyber threats and ICT vulnerabilities relevant to their ICT-supported business functions, information assets, and ICT assets.” Penalties may reach up to 1% of average daily revenue in the preceding fiscal year for each day of noncompliance.
Effective: November 2025 for vulnerability handling and incident reporting Impact: Very high
Perhaps the most ambitious of them all, the CRA (for which Bugcrowd was an advisor) seeks to ensure that “hardware and software products (have) fewer vulnerabilities, and manufacturers take security seriously throughout a product’s life cycle.” Specifically, the CRA will regulate all products that depend on remote data processing (which is nearly everything, these days). Under the CRA, manufacturers of “critical” products will be required to carry out security assessments across the product life cycle and implement various vulnerability handling procedures, including adopting a policy for coordinated vulnerability disclosure, creating a software bill of materials (SBOM), and remediating flaws without delay. Importantly, the CRA will apply to non-EU entities to the extent that they import, distribute, or sell in-scope products in the EU market. This means that the CRA could have an impact on product and organizational security on the same level as GDPR. Penalties for noncompliance may reach €15 million or 2.5% of annual revenue, whichever is higher.
These regulations may have a massive impact on how cybersecurity is executed. In line with CISA’s “Secure By Design” initiative in the US (Bugcrowd has taken the pledge!), these regulations reflect a tectonic shift in security responsibility from users to manufacturers and providers, including their supply chains.
So what to do now, as a start?
Bugcrowd can help you achieve compliance with these regulations in numerous ways, and with all the benefits of doing so on a flexible, multi-purpose platform for scale. Consider the following advantages Bugcrowd offers:
Wherever you are in your compliance journey, we’re here to help, whether you’re taking your first step or going beyond. Bugcrowd is sure to elevate your cybersecurity posture every step of the way.