There are several factors that may be holding the pharma industry back from better information security practices: Resource constraints: Many pharma companies may not have the resources or expertise to implement the latest security technologies and practices. This can leave them vulnerable to attacks and data breaches. Lack of awareness: Some pharma companies may not be fully aware of the extent of the cybersecurity threat landscape and the potential risks to their business. This can lead to complacency and a lack of investment in cybersecurity measures. Legacy systems: Many pharma companies rely on legacy systems that may not be compatible with newer security technologies. This can make it difficult to implement effective security controls and upgrade their cybersecurity infrastructure. Complexity: The pharma industry is highly complex, with numerous stakeholders and a vast amount of sensitive data that must be protected. This complexity can make it difficult to implement effective security controls and ensure that all stakeholders are following best practices. Regulatory compliance: While regulatory compliance is important for protecting patient data and ensuring the safety and efficacy of drugs, it can also be a barrier to implementing new security technologies and practices. Compliance requirements can be complex and time-consuming to meet, which can divert resources from other security initiatives. Perception: Many decision makers in the industry who are not knowledgeable enough about information security and the risk based approach, assume that more security means more steps to complete a task and a bad user experience. They do not realise that in most cases the best practice either replaces insecure steps rather than adding more or the user experience can be made more secure and easier for the user by embracing newer technology. Overall, the pharma industry must overcome these challenges to implement better information security practices and protect their critical assets from cyber threats. This will require a concerted effort from all stakeholders, including industry leaders, regulators, and cybersecurity experts. Kurt Haynes MSc CISSP CCSP CISM CDPSE