Business processes are not only becoming more complex, they are also becoming more digital. Communication between machines is now the rule rather than the exception. The problem: growing demands on cyber security are overwhelming many companies. According to the study "IoT - but secure. Secure infrastructures in a networked world", conducted by the research and analyst firm Techconsult on behalf of Secunet, companies in Germany see data protection (43%) and security concerns (36%), a lack of expertise (38%) and integration into the existing IT infrastructure (36%) as the biggest hurdles when implementing IoT projects. Almost half (46%) also stated that they did not have sufficient expertise, while 38% simply lacked the necessary specialist staff.

As a result, many companies are not investing enough in cyber security, which can have serious consequences in the event of a cyberattack. The German government has now recognized this and created modern guidelines for IT security with the IT Security Act 2.0. It offers companies guidance - regardless of whether they are legally affected or not.

Not mandatory, but a role model for the industry

Since 2015, the IT Security Act (IT-SiG) has formed the basis for protection against cyberattacks for operators of critical infrastructure in the energy, water, food, information technology and telecommunications, transportation and health sectors. The municipal waste disposal sector and companies of special public interest, including Germany's economically strongest companies, are also affected by the amendment. The guidelines defined therein serve to prevent damage by obliging companies that are essential to the functioning of society to structurally modernize their cybersecurity concepts. Starting with a well thought-out network structure that takes risks into account from the outset, this also includes a systematic organization of network access and suitable means of detecting attacks at an early stage.

These are all issues and challenges that are also familiar to industry. After all, the advancing automation and machine communication in the Industrial Internet of Things (IIoT) also place high demands on cyber security here. However, medium-sized companies in particular often lack the expertise and support to be prepared and react quickly in the event of damage. For this reason, too few or even no measures are taken in many cases. In the event of damage, insurance often does not help, as it requires a basic level of security, which usually includes the installation of an up-to-date firewall, regular data backups and the creation of back-ups, individual access for employees and regular password changes.

Yet comprehensive IT security would be particularly relevant for small companies: According to a Techconsult study, almost 30% of companies with fewer than 999 employees were targeted by cyber criminals in 2021.

Advantages of structured cyber security

Even if companies in the industrial sector are not subject to the statutory regulations, they should still be guided by the applicable standards that have been established since 2015. This offers several advantages:

Effectiveness: