Security and privacy standardization for the SME community

Size: px

Start display at page:

Download "Security and privacy standardization for the SME community"

Delphia Greene
8 years ago
Views:

1 Security and privacy standardization for the SME community NLO meeting, Athens, March 4th 2015 European Union Agency for Network and Information Security

2 PROJECT CONTEXT European Union Agency for Network and Information Security 2

Information Security in SMEs 60% of SMEs had a security breach in 2014 82% of SMEs consider information security a high or very high priority in 2014, with 31% having as their main driver to protect

3 Information Security in SMEs 60% of SMEs had a security breach in % of SMEs consider information security a high or very high priority in 2014, with 31% having as their main driver to protect their costumer information 40% of SMEs don t an have an information security policy 42% of SMEs don t plan or implement ISO 27001, while only 18% completely implement it. European Union Agency for Network and Information Security 3

40% of SMEs don t an have an information security policy 42% of SMEs don t plan or implement ISO 27001, while

4 PROJECT OBJECTIVES European Union Agency for Network and Information Security 4

OBJECTIVES To prepare a collection of the existing ICT security and privacy (S&P) standards that can be used by European SMEs To determine the main gaps & obstacles in S&P

5 OBJECTIVES To prepare a collection of the existing ICT security and privacy (S&P) standards that can be used by European SMEs To determine the main gaps & obstacles in S&P standardization for the SME community To elaborate recommendations for improving adoption rate of S&P standards European Union Agency for Network and Information Security 5

standardization for the SME community To elaborate recommendations for improving adoption

6 PROJECT PHASES European Union Agency for Network and Information Security 6

Stock taking on standards International or European standard developing organizations, professional associations, industry associations, etc.

7 Stock taking on standards International or European standard developing organizations, professional associations, industry associations, etc. Specific standards targeting SMEs Standards for codes of practices, for securing business processes, for procuring secure products, for regulatory compliance, etc. European Union Agency for Network and Information Security 7

Specific standards targeting SMEs Standards for codes of practices, for securing business

8 Preparing questionnaire Determining the level of adoption of S&P standards by European SMEs Discovering the obstacles for the adoption of ICT S&P standards in SMEs Finding areas where standards would be useful to fill existing gaps Proposing strategies that could be introduced to support SMEs European Union Agency for Network and Information Security 8

standards would be useful to fill existing gaps Proposing strategies that could be introduced

9 Preparing and conducting interviews Who are our target respondents? International and European standard developing organizations Professional and industry associations developing or promoting the use of standards in SMEs Small businesses associations Existing large initiatives aimed at promoting ICT security in SMEs European Union Agency for Network and Information Security 9

developing or promoting the use of standards in SMEs Small businesses associations Existing large

10 Analysis of results of the interviews The status and gaps on the adoption of standards in the SME community The existing needs of the small businesses in this area The main perceived obstacles for adopting standards The possible instruments to move forward in this field European Union Agency for Network and Information Security 10

perceived obstacles for adopting standards The possible instruments to move forward in

11 Online privacy tools portal PROJECT RESULTS European Union Agency for Network and Information Security 11

A report covering: List of existing ICT S&P standards that can be used by European small businesses. Main conclusions regarding the status of S&P standardization in SMEs.

12 A report covering: List of existing ICT S&P standards that can be used by European small businesses. Main conclusions regarding the status of S&P standardization in SMEs. Recommendations on how to increase the adoption of ICT S&P standards in small businesses. European Union Agency for Network and Information Security 12

Main conclusions regarding the status of S&P standardization in SMEs.

13 Online privacy tools portal YOUR INPUT European Union Agency for Network and Information Security 13

14 How could you help us? Please contact us if you: Can propose any organization that would be interested in participating in the study Are aware of the existence of S&P standards specifically targeting SMEs in your MS European Union Agency for Network and Information Security 14

interested in participating in the study Are aware of the existence of S&P

15 Thank you Follow ENISA: European Union Agency for Network and Information Security

ENISA and Cloud Security

ENISA and Cloud Security Rossen Naydenov Network Information Security Officer Critical Information Infrastructure Protection Department - ENISA European Union Agency for Network and Information Security