A representative study by G DATA CyberDefense highlights the difficulties faced by the German business sector in implementing regulations
Regulatory requirements in the field of IT security, such as NIS-2, present major challenges for nine out of ten companies in Germany when it comes to implementation. This is shown by the report ‘Cybersecurity in Figures’ by G DATA CyberDefense, Statista and brand eins. Most companies are struggling with high costs (32 per cent), followed by extensive documentation requirements (31 per cent) and technical complexity (27 per cent). It is clear that IT security and compliance must be more closely integrated within organisations.
Companies must continuously review, adapt and document their IT security in order to comply with regulatory requirements or sector-specific guidelines. This is no longer solely a matter of technical safeguards. Organisational processes, staffing levels and financial resources also play a crucial role. This is highlighted by the representative study “Cybersicherheit in Zahlen”. Almost a third of respondents from German companies cite high financial burdens as a major concern, closely followed by time-consuming documentation requirements that tie up resources (31 percent). However, technical complexity (27 percent) and tight deadlines (25 percent) also make it difficult to implement the guidelines.
“IT security needs clear rules, not unnecessary bureaucracy. High costs, excessive documentation and complicated requirements tie up valuable resources within companies. The focus should be on protection against genuine risks. Politicians must set clear legal guidelines here and ensure that requirements are comprehensible, practical and consistently geared towards the actual risk. This leaves more time and money for what really matters: the security of our economy,” says Andreas Lüning, co-founder and member of the board at G DATA CyberDefense.
Thinking about IT security and compliance as a wholeWithin organisations, regulatory requirements are primarily implemented at an organisational level. In addition to adequate resources and processes, a fundamental understanding of the requirements is essential. Clearly defined responsibilities are also crucial. External IT security experts and managed security services can help to ease the burden on internal teams and support day-to-day security operations. However, responsibility for compliance with legal requirements remains with the respective organisation.
The findings from “Cybersicherheit in Zahlen” show that organisations need to integrate IT security and compliance more closely. It is crucial not to view regulatory requirements as isolated obligations, but to integrate them into a long-term and economically viable security strategy.
Cybersicherheit in Zahlen – download here“Cybersicherheit in Zahlen” has been published for the sixth time and is characterised by a wealth of information and particular methodological rigour. As part of a representative online survey, more than 5,000 employees in Germany were questioned about cybersecurity in both a professional and private context. The experts at Statista closely oversaw the survey and, thanks to a sample size that far exceeds the industry standard, present reliable and valid market research findings in the magazine “Cybersicherheit in Zahlen”. Furthermore, this reference work provides figures, data and facts drawn from more than 300 statistics covering all aspects of IT security.
Anyone interested can download “Cybersicherheit in Zahlen” here.