By Mark Molyneux
Launched earlier this year, the FBI’s Operation Winter SHIELD lays out ten actions that organizations can take to strengthen resilience against cyber intrusions, from phishing-resistant authentication to managing third-party risk. It offers a practical roadmap aligned with the National Cyber Strategy and the FBI Cyber Strategy, to strengthen resilience by helping organizations identify where threat actors are focusing their activity and how to reduce opportunities for exploitation.
Yet even the most sophisticated roadmap is only as effective as those tasked with executing it. For organizations operating globally, that becomes more difficult as multiple nations publish cyber action plans and delivery strategies, with each bringing its own regulatory requirements and operational assumptions.
Coordinating these protocols means applying common measures, such as secure authentication and incident response, across countries with different requirements. Without effective coordination across borders, even well-intentioned guidance can leave vulnerabilities unaddressed.
Where consistency breaks down
The typical global organization is likely to have a central security strategy, but its regional operations will still be subject to national rules and expectations; and some of the differences can be significant.
Critical systems are often shared across national or regional boundaries. They may include a centralised identity platform, cloud services used throughout the business, or a specialist supplier supporting several markets. As many incidents have shown, a cyber attack that begins in one location can disrupt services in another. Regional teams may also have different processes for managing a breach or restoring affected systems, shaped in part by local rules and regulations.
If these processes are not connected by a common model, consistency can quickly break down. This can lead to delays and confusion when an incident affects more than one part of the organization, making coordination even more difficult. It can also leave the victims of cybercrime open to multiple regulatory breaches and enforcement actions from more than one authority.
The coordinated response challenge
This operational resilience gap is the space between having appropriate national guidance and being able to apply it consistently across a multinational organization. For many businesses, it remains a significant weakness. Such delays in consistent implementation can leave vulnerabilities exposed, even when the risks are already understood years earlier.
Rather than treating regulation as a deadline to work towards, organizations should use it as a baseline for action. Building resilience earlier gives multinational organizations time to turn broad regulatory principles into consistent operational practices across different markets, systems, and teams.
Closing this gap depends on first identifying the services the company must be able to maintain, regardless of where they are delivered. This means looking beyond individual applications or national operations to understand the wider dependencies behind each service.
For example, a customer-facing service in one country may depend on an identity platform or supplier managed elsewhere. When that’s the case, the organization then needs a common approach to assessing business impact and deciding which services must be prioritised when an incident occurs.
But the organization has to strike a sensible balance. Local teams should retain responsibility for meeting national obligations, including regulatory reporting and engagement with local authorities. However, they should do so within an agreed global response and recovery framework that gives central teams visibility of the wider disruption, while helping regional teams act quickly without waiting for decisions to be made from scratch.
Getting this right takes practice and the aim should be to identify gaps before a real incident exposes them. A coordinated response cannot be established through policy documents or compliance assessments alone. Instead, businesses need to exercise scenarios that affect shared infrastructure, a major supplier, or several markets at once. These should test how quickly regional teams can identify the impact on critical services and escalate decisions. Learnings should feed back into the global framework, while allowing regional teams to refine their local procedures.
Moreover, a major cyber incident may require organizations to work with regulators or national cyber agencies in more than one country and, in many jurisdictions, reporting is now mandatory. But if possible, organizations shouldn’t wait until a live incident occurs before establishing these relationships.
At an international level, businesses should understand who needs to be notified in each jurisdiction and how information will be shared across the wider response. They should also ensure that local reporting obligations do not prevent central teams from building a complete picture of the incident.
These are important considerations as far as the regulatory authorities are concerned, because resilience rules will continue to develop in line with the threat landscape. This is particularly true at present when AI is changing the nature of risk so quickly. The longer it takes to address any gaps in operational resilience, the more difficult it will be to respond consistently when disruption occurs.
The author
Mark Molyneux is Field CTO, Commvault
