Why compliance does not guarantee cyber resilience
Brief
Cyber security has become one of the most audited and regulated areas of enterprise technology. Yet an organisation can satisfy every requirement on paper and still discover, during a real incident, that its systems, people or processes are not ready for the pressure that follows.
Compliance can demonstrate that controls have been put in place; it cannot, on its own, demonstrate that those controls will continue to work when a critical service is disrupted. Here, Nathan Charles, head of customer experience at cyber resilience specialist OryxAlign, explains why organisations need to look beyond compliance and test whether their resilience claims stand up in practice.