Why all companies should care about the UN's cybersecurity & software update regulations – lessons for all sectors - Articles Droit de l'informatique - lexgo.lu
Here are some takeaways, from insights into the need for and scope of a cybersecurity management system to detailed lists of threats and mitigation measures. And what better time to put these on your organisation's agenda than the European Cybersecurity Month (and even Cybersecurity Week in Luxembourg)?
Regulation 155 contains many considerations that are useful when considering compliance with other legal requirements in terms of information security. First, it defines a CSMS as “a systematic risk-based approach defining organisational processes, responsibilities and governance to treat risk associated with cyber threats to vehicles and protect them from cyberattacks”. Replace “vehicles” with “assets”, “personal data” or “information”, and a CSMS should be the cornerstone for your company’s cybersecurity approach. Regulation 155 makes the CSMS central to compliance: without a CSMS, a vehicle manufacturer cannot obtain a specific certificate, which in turn means that it cannot place its products on the market. The same idea is present in embryonic form in the NIS (Network & Information Security) Directive and its national implementations, and even under the broader data protection rules, given that inadequate cybersecurity can make an entire processing activity unlawful and lead to fines as well as an order to stop the processing activity.
Lesson: having a good cybersecurity approach can be crucial to the quality of products or services and sometimes even to the right to place them on the market. Companies must devise a global cybersecurity strategy, and document it. Our article on How to explain the legal aspects of cybersecurity to the Board of Directors may come in handy.
Lesson: ensure that your company’s cybersecurity approach applies to the entire lifecycle of the product or service, and that there are processes in place to keep on (re-)evaluating the overall risk level as well as specific threats even after a particular product or service ceases to be provided. Given that new regulatory requirements can impact the level of risk, (in-house or external) lawyers should also be involved in such reviews.
Lesson: even if your company is not involved in the building of a particular component or the provision of a specific service, it must check (within reason) that its supplier or subcontractor acts responsibly in relation to information security. Build such verifications into a supplier onboarding process or consider a contract negotiation playbook.
Lesson: after preparing a risk assessment, with identification of both threats and mitigation measures, ensure consistency with the incident response plan, so that the company can show that its risk assessment is a good starting point. If needed, ensure that any risk assessment weaknesses discovered during an incident are used as an opportunity to improve. In addition, in the event of an incident, check that the processes put in place are properly observed, to limit the legal risk that could arise from the response itself.
Lesson: build assessments into an update process, as even in other sectors failure to anticipate the impact of an update (and to inform users – see below) could facilitate claims for damages regarding the direct consequences of the update.
Lesson: transparency is key. Operational teams must pay attention to the need to manage user expectations and avoid a situation that could lead to a complaint or to liability, and being transparent can strongly help here.
Lesson: security of a particular software package is not all that matters – security of the update mechanism is just as crucial. Flawed update security can have a significant legal impact, so ensure that processes are secured against such risks.
The overall lesson? As laws become more technical, a dialogue between legal and technical teams is no longer just best practice; it becomes a necessity. If they do not speak the same language, be sure to bring in outside help!
See this link: www.lexgo.lu/fr/articles/ip-it-telecom/droit-de-l-informatique/why-all-companies-should-care-about-the-un-s-cybersecurity-software-update-regulations-ai-lessons-for-all-sectors,148269.html