BDO USA, the American arm of a global accounting network, found that a significant amount of companies don't have digital-related changes on their radar, according to its 2018 BDO Cyber Governance Survey.

About one-third of public company directors who took the survey, 34 percent, said their company currently has no digital transformation strategy and doesn't plan on developing one in the near future.

“A digital transformation strategy is creating a set of capabilities for an organization to meet a future business opportunity,” explained Greg Reid, a BDO managing director who leads its national data privacy practice.

He added that such a strategy would include such things as “machine learning, artificial intelligence, robotic process automation—what we consider to be technology-related capabilities.”

It will also include even the more basic capabilities, “like organizational change management, business process management, and policies and procedures on how to use [technology],” Reid said.

Twenty-nine percent of respondents said their companies have not increased budgets for digital initiatives, hired board members with digital or relevant skills or introduced new metrics to measure related insights.

Those companies, Reid said, might have a rocky future if they don't work on a plan.

“It seems [that] in order to stay competitive with the future, this is something you must do,” he said. “It's a core competency, [it] has to be a core competency, of organizations out there.”

The survey also looked at how companies are meeting data privacy laws, including the European Union's General Data Protection Regulation, which went into effect in May. The California Consumer Privacy Act was signed the following month, though it doesn't go into effect until 2020.

Reid said the two regulations could be a sign of what's to come, and businesses, even those not impacted by GDPR or the CCPA, should be prepared to meet a baseline of privacy principals established by global organizations.

“Let's meet privacy obligations in general, and then no matter what comes out you'll be prepared for the future, because we don't know what's coming out. … We can't predict,” Reid said. 

Just 32 percent of respondents said their companies increased data privacy budgets. Another 32 percent have appointed a data protection officer, which GDPR requires for certain companies. Companies knowingly impacted by the GDPR are taking steps to comply, Reid said.

Nearly 70 percent of respondents said their companies were not impacted by GDPR, but Reid said that some of those companies likely do fall under GDPR but are unaware of it.

The report also looked at cybersecurity. Nearly eight in 10 respondents said they avoided a data breach over the past two years and that their company board is becoming more involved in cybersecurity. But only 34 percent have conducted a former audit of their cybersecurity program, while a quarter of respondents' companies haven't started addressing the U.S. Securities and Exchange Commission's cyber breach disclosure obligations.

“People, meaning companies, are stepping up to their responsibilities and obligations in this area,” Reid said. “We'll get there.”