As cyber-attacks get bigger and more sophisticated, governments of different nations are implementing new laws to ensure protection of vital services and infrastructure. The European Union is not an exception as the NIS2 Directive (the Directive (EU) 2022/2555) was recently adopted. It is a cybersecurity regulation intended to boost the cybersecurity resilience of key and important infrastructures.

Based on the initial Network and Information Systems (NIS) Directive of 2016, the NIS2 Directive covers more organizations and imposes higher cybersecurity standards, as well as puts more responsibility on management. Businesses that are present in the EU or provide their services to EU organizations should prepare for this law.

What is the NIS2 Directive?

The NIS2 Directive is an updated piece of legislation that aims at ensuring the high level of cybersecurity in all Member States of the European Union. It replaces the initial NIS Directive and takes into account modern threats and increasing importance of the digital infrastructure.

This directive creates a set of rules for risk management, reporting and cooperation among the EU Member States, and intends to standardize cybersecurity measures throughout all Member States.

Who Does NIS2 Apply To?

Another remarkable change brought about by NIS2 is the widened scope. Unlike NIS1, which had a limited applicability towards operators of essential services and specific types of digital service providers, NIS2 now applies to more medium and large entities active in sectors deemed important for both economic and societal reasons.

These sectors encompass energy, transport, finance, healthcare, drinking water, sewerage, digital infrastructure, public administration, and space services. Moreover, some other sectors are now included, such as the postal sector, waste management, food manufacturing, chemicals, research centers, and manufacturers of critical goods.

Thus, through widening the number of sectors covered, NIS2 makes sure that critical supply chains and public services will have proper cybersecurity practices.

Key Cybersecurity Requirements

NIS2 introduces comprehensive risk management measures that organizations must implement to protect their networks and information systems. Rather than prescribing specific technologies, the directive adopts a risk-based approach, allowing organizations to implement controls appropriate to their size, operations, and risk profile.

Key requirements include establishing cybersecurity policies, conducting regular risk assessments, implementing incident response procedures, ensuring business continuity, managing vulnerabilities, maintaining secure backup processes, and protecting network infrastructure.

A significant addition under NIS2 is the emphasis on supply chain security. Organizations are expected to evaluate the cybersecurity posture of suppliers, contractors, and third-party service providers, recognizing that attacks on vendors can have widespread consequences.

Incident Reporting Obligations

Fast reporting of cybersecurity incidents is yet another notable characteristic of the directive. The entities are supposed to report to the respective authorities in case any significant cybersecurity incident happens and might interfere with their service provision.

The reporting process will usually entail an initial alert immediately upon being informed about the incident, followed by a more detailed notification after some time and, lastly, the final report once all the investigations and the recovery process has been done.

These requirements will enhance information sharing and enable coordination in the response to the threats among the Member States.

Management Accountability

Maybe one of the most revolutionary characteristics of the NIS2 directive is the added accountability of executive management. The issue of cybersecurity is no longer seen as merely an IT matter; rather, it is considered to be a critical business responsibility.

Senior management is supposed to approve cybersecurity risks management measures and monitor the compliance measures, resource allocation, and training of staff members in cybersecurity issues. Serious failure to comply with the regulations may result in management facing the consequences.

Benefits Beyond Compliance

While regulatory compliance is a primary objective, implementing NIS2 requirements also delivers significant business benefits. Strong cybersecurity practices help organizations reduce operational disruptions, improve resilience against ransomware and other cyberattacks, strengthen customer trust, and protect valuable data and intellectual property.

Enhanced incident response capabilities also enable organizations to detect, contain, and recover from cyber incidents more efficiently, minimizing financial losses and reputational damage. Furthermore, stronger supply chain security helps reduce risks associated with third-party vendors and external service providers.

By adopting a proactive approach to cybersecurity, organizations can improve overall operational resilience while demonstrating their commitment to protecting customers, partners, and critical services.

Preparing for NIS2 Compliance

It is crucial to ascertain whether or not the entity is in the directive's scope of application. Starting with a cybersecurity risk assessment and reviewing the current state of policy, governance, and technical controls is the way to go. Businesses should develop incident response plans and implement continuous vulnerability management, evaluate supplier security, perform regular cybersecurity awareness training and monitor the compliance status. Most organizations opt for aligning their cybersecurity program with globally established standards, such as ISO/IEC 27001 or NIST Cybersecurity Framework, which may help them on the path to NIS2 compliance.

Conclusion

In conclusion, it needs to be noted that the NIS2 Directive marks a major step forward for the European Union concerning its cybersecurity legislation. The directive expands the coverage, improves risk management requirements, introduces improvements into the process of reporting, and increases executive accountability.

Early preparation can be helpful for entities to ensure they meet the regulations as well as improve their cybersecurity position. In the modern world, which faces growing number of sophisticated cyber incidents, NIS2 becomes not only a mandatory requirement but also an opportunity to enhance organizational resilience.

A complete Masterclass on NIS2 Directive is out right now!

By Shara Najimudeen, Digital Marketing Executive, GLC Europe, Colombo Office, Sri Lanka.