{"id":43638,"date":"2023-08-31T11:51:39","date_gmt":"2023-08-31T10:51:39","guid":{"rendered":"https:\/\/www.elixirr.com\/?p=43638"},"modified":"2025-11-07T17:11:24","modified_gmt":"2025-11-07T17:11:24","slug":"cyber-national-security-understanding-the-importance-of-national-security-investment-reviews-and-regulations","status":"publish","type":"post","link":"https:\/\/www.elixirr.com\/en-gb\/cyber-national-security-understanding-the-importance-of-national-security-investment-reviews-and-regulations\/","title":{"rendered":"Cyber-national security: understanding the importance of National Security Investment Reviews and regulations"},"content":{"rendered":"\n

This piece is written by Elixirr\u2019s cybersecurity experts, in collaboration with John Lash<\/a>, Founder of specialised security consultancy, Darkhorse. John has worked with our team for several years on a number of strategic and tactical cybersecurity projects, bringing his deep expertise and knowledge to support across multiple client engagements.<\/em><\/strong><\/p>\n\n\n\n

Today, the nations of the world have integrated so much so that digital technology is both apparent in every man-made structure and beamed across the globe wirelessly, and invisibly, by satellites and other devices. All these interconnections present a tremendous opportunity, but also a pathway for bad actors. Cyber threats and incidents are front-page news, causing public humiliation and financial loss to governments and organisations alike. These threats must be dealt with in a way that safeguards national security, protects economic stability and ensures personal privacy.<\/p>\n\n\n\n

As global economic conditions continue to be volatile, the landscape for investments, mergers and acquisitions, and other forms of capital markets activity, remains highly dynamic. However, considering the current geopolitical environment, market participants must recognise that not all capital is treated equally \u2013 whether a company seeking to raise funds, or investors looking to deploy funds into opportunistic investments worldwide, it varies significantly. A key component of the risk in these investment activities relates to cybersecurity risks, including how resilient a company may be to potential cyber threats and how mature a company’s cybersecurity posture is to protect and defend against a new era of emerging risks. <\/p>\n\n\n\n

Learning from past data breaches<\/strong><\/h2>\n\n\n\n

In 2022,\u00a083%<\/a>\u00a0of organisations experienced more than one data breach. What\u2019s more, companies suffered an average decline of\u00a07.5%\u00a0in their stock values after a breach. One well-known example, the \u2018SolarWinds Supply Chain Attack\u2019<\/a>\u00a0of 2020, is widely regarded as one of the most audacious cyber espionage campaigns. State-sponsored attackers compromised the software supply chain of SolarWinds, a prominent IT company, which led to the infiltration of numerous government agencies and private corporations, highlighting the far-reaching consequences of compromised supply chains.<\/p>\n\n\n\n

Learning from SolarWinds, it\u2019s clear that a National Security Investment Review (NSIR) is hugely important \u2013 a NSIR assesses foreign investment in sensitive industries, seeking to minimise risks and prevent adverse national security outcomes. Read on for insights and lessons learned from NSIRs with global institutions across the US, UK and Europe. <\/p>\n\n\n\n

The origin of NSIRs  <\/strong><\/h2>\n\n\n\n

The creation of NSIRs can be traced to a variety of contributing factors: national security concerns, foreign investment and risk associated with sensitive technologies.<\/p>\n\n\n\n

The Committee on Foreign Investment in the United States<\/a> (CFIUS) is the main governing body that assesses foreign investments for national security risks. The committee dates to 1988 and the Exon-Florio amendment, which empowered the President of the United States to suspend or prohibit certain merger and acquisition deals that could pose a threat to national security. Since that time, the authority of CFIUS has been expanded twice: once in 2007 by the Foreign Investment and National Security Act of 2007 (FINSA) and again in 2018 by the Foreign Investment Risk Review Modernization Act (FIRRMA). In 2022, President Biden issued the first-ever presidential directive (Executive Order 14083)<\/a> to further address evolving national security risks and enforcement guidelines; the directive focused on key areas including cybersecurity risks, sensitive data, and US technological leadership. <\/p>\n\n\n\n

Across the pond<\/strong><\/h2>\n\n\n\n

In the UK, an equivalent governing body exists, established by the National Security and Investment Act of 2021 (NSIA)<\/a>, which granted the government the power to scrutinise and potentially block or modify investments that pose a threat to national security.<\/p>\n\n\n\n

Throughout Europe, NSIRs vary country to country, as there is no pan-European framework for national cybersecurity regulation; although the European Union heavily encourages that member states follow foreign investment screening regulations. As of June 2023<\/a>, 18 member states now have new or revised regimes in place and 5 are expected to follow suit later this year, leaving Bulgaria<\/a> as the only member state with neither an existing nor proposed foreign investment screening regime. <\/p>\n\n\n\n

The common thread across NSIRs worldwide is an expansive focus on cybersecurity as it relates to the protection of critical infrastructure, sensitive data and intellectual property of companies and their customers, as well as protecting government operations. Throughout the review process, companies and investors must be able to define how their cybersecurity programs deter and prevent cyberattacks, protect their infrastructure and sensitive data, and remain free from outside interference.<\/p>\n\n\n\n

Practical advice<\/strong><\/h2>\n\n\n\n

Global interconnectivity and reliance on technology is not slowing down, and therefore cybersecurity will remain the lynchpin of security and compliance efforts. While many companies are already investing heavily in cybersecurity, many of the security conditions imposed by governments during NSIRs involve an expansion of these efforts with respect to cybersecurity posture and model maturity. When considering investment activity that will fall within NSIR regulations, businesses must consider the following: <\/p>\n\n\n\n