UK firms could soon find themselves under pressure to comply with tough security standards introduced in the US last week. The Information Security Governance proposals, designed by a taskforce appointed by the US government, could form the basis of new rules in the UK.

Bill Conner, head of security firm Entrust and co-chairman of the US taskforce, said that Whitehall was considering a similar scheme to make organisations more accountable for their IT defences.

"I am already talking with the UK government and [e-commerce minister] Andrew Pinder about this," said Conner. "The framework is global in nature and can be applied to UK and European firms. We took great care to ensure all the standards used reflected an international view since cyber security cannot be contained within the physical borders of a single country."

Under the US proposals, firms would have to assign security managers and periodically assess risks. Compliance with the new guidelines is not yet mandatory, but Amit Yoran, director of the National Cyber Security Division at the US Department of Homeland Security (DHS), said companies should make information security a priority. He added that the DHS supported the use of tools described in the taskforce's report.

The proposals advise firms to take advantage of established international standards such as ISO 17799, which forms the basis of the US framework.

"We are encouraging organisations to use security best practices guidance, such as ISO 17799, to measure information security performance," said Conner. "I would hope that this would result in greater uptake of these security standards."

The UK's Information Commissioner also recommends ISO 17799 compliance for large firms, to meet the security requirements of the Data Protection Act.

Despite the high cost of certification, the number of firms achieving the ISO 17799 standard has grown steadily, following new rules on corporate governance in the wake of the Enron scandal. In August 2002, about 130 firms were certified. This has now risen to just over 600 worldwide.

Fred Cohen of analyst firm Burton Group said corporates should aim for compliance with the standard. "Anyone with more than a few hundred staff would be foolish not to comply," he argued.

Japan has the highest number of certified firms, with 276, followed by the UK with 129, and India in third place with 28. This may indicate that India is taking IT security issues seriously given the concerns of European organisations that facilities in India could create weak spots in their protection.