In the digital age, effective cybersecurity is synonymous with business resilience. As cyber threats escalate, companies must stay ahead of the curve with up-to-date knowledge of data protection regulations.

This post will provide an in-depth analysis of the latest U.S. government and FBI cyber threat warnings, an overview of the American legislative framework, a comparison with European data protection laws, and the implications for U.S. businesses operating internationally.

The Current States of Cybersecurity: Government and FBI Warnings 

The recent surge in cyber threats has prompted urgent warnings from the U.S. government and the FBI, including this month’s joint cybersecurity advisory statement from CISA, FBI, NSA, and international partners regarding Iranian cyber operatives executing attacks against critical infrastructure. This heightened vigilance and the dissemination of critical advisories demonstrate the U.S. government’s commitment to proactively countering cyber threats. Additionally, the collaborative efforts to issue timely alerts are a testament to the nation’s robust cybersecurity infrastructure.

The 2024 Report on the Cybersecurity Posture of the United States, prepared by the Office of the National Cyber Director within the Executive Office of the President, provides a comprehensive assessment of the nation’s cybersecurity stance. It evaluates the effectiveness of current cyber policy and strategy and the status of their implementation by federal departments and agencies. Here are the key points outlined in the report:

Cybersecurity Threats and Issues in the United States

• Evolving risks to critical infrastructure from nation-state adversaries targeting systems without espionage value to further their strategic objectives.
• Ransomware remains a significant threat, with attackers employing sophisticated strategies such as “double” and “triple extortion” tactics.
• Supply chain exploitation has enabled large-scale compromises through interconnected technology supply chains.
• The commercial spyware market has expanded, with private vendors selling invasive tools to nation-state actors, raising security and privacy concerns.
• Advances in A.I. technology have introduced both opportunities and challenges for cyber risk management.

These alerts highlight a new wave of sophisticated cyber-attacks that target various sectors from supply chain to technology. The implications for businesses are significant; companies are urged to enhance their cybersecurity defenses and remain vigilant. Employee training and updated security protocols are no longer optional but essential to safeguarding digital assets. So, what does your organization need to know? Let’s explore the legislation.

Legislative Landscape in the USA

The United States does not have a comprehensive federal data protection law. Instead, it adopts a sector-specific approach with legislation such as the Health Insurance Portability and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act (GLBA). However, the legislative landscape is shifting. Potential upcoming bills and regulations could introduce new cybersecurity requirements, emphasizing the role of compliance in a company’s data protection strategy.

According to Pew Research Center, 72 percent of Americans believe the U.S. government needs to provide more regulation regarding personal data usage. While no comprehensive federal legislation has passed, states are taking action to protect their citizens. California, Colorado, Connecticut, Utah, and Virginia implemented rights-based data protection legislation as of 2023. Twelve additional states followed their example, passing legislative protection of privacy to go into effect between 2024 and 2026. The enforcement of these laws will be something to watch, but it’s certainly worth noting if your organization has connections in these states.

Of course, staying compliant is more than just adhering to legal mandates; it’s about building customer trust and ensuring the integrity of your business operations.

Comparing Data Protection in the USA and Europe 

The contrast between the U.S. and Europe regarding data protection is stark. While the U.S. continues to employ a sectoral approach, Europe’s General Data Protection Regulation (GDPR) provides a holistic and stringent framework applicable to any entity processing the data of persons located in the European Union. Where the U.S. adopts a harm-prevention approach, the European Union focuses on the rights of individuals to control their data.

GDPR’s influence is far-reaching, impacting U.S. companies that operate in Europe. These companies have had to significantly adapt their data handling and processing practices to comply with the GDPR. At year-end of 2022, “more than 91 percent of companies in the United States legally expected to comply with GDPR were underprepared to meet the privacy legislation.”

Of note, many U.S. companies must be made aware that they must comply. Article 3 of GDPR specifies that companies that are “data processors” or “data collectors” of any person located in the E.U. must comply. This includes U.S. companies collecting data from staff, clients, freelancers, website leads, etc. Something as simple as receiving an email from someone located in Europe with personal contact information such as a phone number or email address requires compliance with GDPR. As a result of this, Persona reports that 32 percent of U.S. companies have a data protection officer as of 2024 to ensure compliance.

For U.S. companies operating, outsourcing, or sharing data with Europe, responsibilities include:

• Ensuring all data transfers align with GDPR requirements.
• Adopting robust security measures to protect personal data.
• Where necessary, appoint a data protection officer (DPO).
• Conducting regular data protection impact assessments.
• Maintaining transparency with data subjects about the use of their data.

Cybersecurity and Data Protection Considerations 

Organizations today must focus on creating a comprehensive data breach response plan and stay current with international data flow challenges, especially after the invalidation of the Privacy Shield framework by the European Court of Justice. According to IBM, 44 percent of data breaches during the pandemic directly involved personal information, and consumers took notice. Consumer privacy awareness is at an all-time high, and by championing data protection, companies can distinguish themselves in a crowded marketplace. The 2024 data privacy benchmark study by Cisco revealed that 95 percent of organizations reported experiencing more advantages than expenses from their data privacy investments, which yielded returns at a ratio of 1.6 times the investment.

Businesses and organizations must remain informed, agile, and proactive to navigate the complexities of cybersecurity and data protection laws. By responding to government warnings, adhering to legislative frameworks, and understanding international implications, companies can protect themselves against cyber threats and regulatory penalties. A commitment to data security and compliance is not just a legal necessity but a strategic advantage in today’s trust-based economy.

Need help assessing your cybersecurity needs or implementing best practices? RKL’s IS Assurance and Advisory team helps organizations identify, evaluate, measure, and manage cybersecurity risks so they can stay productive and protected against current and emerging threats. Learn more about our cybersecurity assessments.

_______________

Michael T. McAllister is the Leader of RKL’s IS Assurance Practice. McAllister serves clients in a variety of industries through information technology internal audits; IT governance, revaluation, and design; and QA/IV&V (Quality Assurance, Independent Verification, and Validation) engagements. He also provides SOC services for various types of entities, ranging from national service bureaus, financial institutional support entities, and data hosting services.