Why Organizations don’t Report Cyber Incidents
Companies are compelled all security incidents, even the ones considered small to regulators. Most governments have regulations that require companies to report cyber incidents. The same obligations also exist under the Health Insurance Portability and Accountability Act (HIPAA). However, law enforcement agencies have little information regarding the number of cybercrimes committed since most companies do not report the incidents. For instance, the FBI’s Internal Crime Complaint Center has revealed that almost a half a million cybercrimes are committed annuals, but only 15% of them are reported.
There are various reasons why businesses are reluctant to report cybercrimes. Most companies do not see the point of reporting cyber security incidents because their goals after an incident are different to that of law enforcers. For instance, organizations often assume that law enforcers will not help them to restore operations and stop the stolen data from reaching the wrong hands. Additionally, law enforcers and companies have different interests and objectives after an incidents. Law enforcers focus on identifying and prosecuting cybercriminals, while the victim’s aim is to remedy the situation by ensuring operations continue within the shortest time possible and ensure it doesn’t happen again (Eric & Malsch, 2020).
Companies might also be reluctant to report cyber incidents because of the expenses and the perception that it may affect the overall reputation of a business. In most scenarios, companies perceive that the incident is not worth taking much time and expense. The time aspect is brought by the fact that in most cases investigating agencies will freeze a company’s systems to allow effective investigations. This means that it will take longer before operations resume. Additionally, law enforcers might publicize such incidents, risking the affected company’s reputation; therefore, most companies prefer solving cyber incidents internally.
References
2016 Internet crime report. https://pdf.ic3.gov/2016_IC3Report.pdf
Eric, R.L., & Malsch, M. (2020). Exploring the Needs of Victims of Cyber-dependent and
Cyber-enabled Crimes, Victims & Offenders, 15:1, 60-77, DOI:
10.1080/15564886.2019.1672229