Iskro Mollov has been the Group Chief Information Security Officer and Senior Vice President of Information Security, Business Continuity, and Crisis Management at GEA Group AG since 2020. Reporting to the GEA Group CFO and Supervisory Board, he oversees a wide range of security domains, including IT and OT security, incident response, and crisis management. Mollov’s career began with a degree in Business Informatics from Friedrich-Alexander-University Erlangen-Nuremberg, followed by roles at AREVA GmbH and Schaeffler AG, where he developed key security systems and led significant global projects. 

In this interview, Iskro shares his expert insights on leveraging cybersecurity as a competitive advantage in today’s digital landscape. He discusses how businesses can align their cybersecurity strategies with broader business objectives, the critical legal considerations for CISOs in 2024, and the profound impact cybersecurity has on business continuity. He also offers valuable advice on preparing C-suite executives for effective decision-making during cybersecurity crises. This conversation is a must-read for anyone looking to enhance their understanding of cybersecurity’s role in driving business success! 

How can businesses leverage cybersecurity as a competitive advantage? 

Cloud security has become increasingly important asI see three major aspects leading to competitive advantage through security for industry companies like GEA: 

  • Security as a compliance topic: in the current business environment it is unacceptable to not fulfill legal and customer security requirements. A lot of customers are making security part of their requests for proposal (RfP) and in order to be successful and be selected for the customer orders robust security measures that are implemented in advance are necessary. A good strategy for that is to orient yourself on well-known and established frameworks and get the appropriate security certificates like ISO 27001. Having those provides additional competitive advantages in the RfP process by efficiently addressing the customer requirements and e. g. skipping the answering of hundreds of questions. The same applies to rating agencies performing, e. g. ESG rating – security is in the meantime part of all such types of reports and a robust foundation leads to competitive advantages in the market. 
  • Actively promoting security: Having well established security measures in place can be proactively used in communication with the customers. At GEA we are actively training our more than 2.000 sales employees and also providing dedicated Customers’ Brochures on Information Security. Especially important for our sales colleagues is how to use the security certificates in order to generate trust with customers – the customer’s information have to be safe and protected in our environment but also promoting the security in our products and generating competitive advantages not only for us but also for our customers – if our manufacturing machines and services are secure so is as well the customer’s environment and on top of that the customer is being helped in fulfilling his own legal requirements like the EU NIS 2 Directive. 
  • Selling Security Products and Service: For an industry manufacturing company like ours there are plenty of opportunities to help customers by providing dedicated OT and IIoT security products and services. What is a better way to generate competitive advantages for us and for the customers and a win-win situation than directly considering security as a business topic? I encourage all my fellow CISOs to focus more intensively in future on the side of the security discipline.    
How can organizations align their cybersecurity strategies with their overall business objectives? 

Let me start with this: “Security” and “Business” should not be considered as separate topics – “Security” should be considered part of the “Business” and the security strategy part of the business strategy and objectives. To make sure that security is appropriately considered we at GEA are using the slogan “Security is my Business. And yours.” The most important prerequisite on the operative level for achieving this is to have the CISO and the security organization engaged in the strategic decisions and being part of the appropriate boards and meetings. In complex organizations visibility and transparency might be missing and this might lead to not considering the security topics on time or losing business opportunities. To avoid this from happening we e. g. renamed a little bit more than one year ago our “Audit Committee” of the Supervisory Board in “Audit and Cyber Security Committee”, security risks and opportunities are being quarterly update in the Enterprise Risk Management (ERM) reporting, the progress of the Global Security Program is at least quarterly being tracked by the Executive Board, and the relevant business functions, divisions and regiones are at least quarterly reporting on security in the Group Information Security Board (GISB).  

In general, every CISO should be aware of the legal requirements in all the countries where his company is doing business. In the case of GEA, we are talking about 62 different countries having mostly different local security legislations. Those must be of course initially assessed but also continuously monitored for changes. Talking about 2024, there are a few new laws and regulations that should be important for most of the companies and their CISO. For example, in the European Union the NIS 2 Directive, DORA and the Cyber Resilience Act (CRA) will apply to a lot of companies depending on the industry sector and I think are already well known and broadly discussed and addressed. But there are also some not so well-known EU regulations which might be easily overlooked like the Radion Equipment Directive Delegation Regulation (RED). We recently analyzed at GEA more than 120 EU digital-related regulations and identified 32 that are applicable for our company. On the more international level the USA SEC Cyber Security Regulations are for sure worth to be mentioned but also the Chinese Cyber Security Laws are quite interesting and emerging. 

How does cybersecurity impact business continuity and the bottom line in today’s digital landscape? 

Cybersecurity is nowadays probably the most important business continuity topic. According to almost all risk reports (like e. g. Allianz Risk Barometer) Cybersecurity is THE top risk for almost every company. From a business continuity point of view the impact of a major cyber incident is almost always a global one and the impact of a business interruption is by far higher than the impact of any other type of Business Continuity Management (BCM) Incident. Most of the other types of business interruptions are locally isolated or can be easier substituted. Examples are natural disasters, fire, flooding, loss of utilities, supply chain interruptions, pandemic, social unrest, or geopolitical instability. With a major ransomware attack for example this is not the case. When IT, Production and Development environments are not available the business is almost completely down. Therefore, it is important that Cybersecurity is an essential part of a holistic BCM strategy and approach. For this reason, at GEA not only the Security but also BCM is part of my scope of responsibility.       

How should businesses prepare their C-suite for effective decision-making during cybersecurity crises? 

Similarly for the Security and BCM topics a holistic approach is needed. The Crisis Management Team (CMT) should consist of all important stakeholders which also include the C-suite. The CMT must then train all types of crisis situations and (as discussed above in regards of BCM) especially the cybersecurity crisis. According to my experience when the C-suite is part of such type of exercises this is a real eye-opener in regards of the impact of such situations and what is required to get back to normal.