The NIS & NIS2 Directive

The first step to comply with NIS2 is understanding whether your organization must comply. We recommend looking at our NIS2 quick reference and referring to your local authorities' guidance.  

Increasing Cybersecurity Resilience 

NIS2 encourages member states and critical infrastructure operators to enhance their cyber security resilience and preparedness to respond to and recover from cyber incidents effectively. 

Harmonizing Cybersecurity Standards 

It seeks to harmonize cyber security standards and practices across the EU to ensure a consistent and high level of security across the digital landscape. 

Mandatory Reporting of Incidents 

NIS2 mandates reporting significant cyber incidents to national authorities and establishes a coordinated mechanism for sharing information on cyber threats and incidents among member states. 

Critical Infrastructure Protection 

The directive specializes in protecting critical infrastructure sectors, such as energy, transport, healthcare, and digital infrastructure, requiring them to meet specific cyber security requirements. 

Enforcement and Penalties 

NIS2 introduces measures for effectively enforcing cyber security requirements and penalties for non-compliance, incentivizing organizations to invest in cyber security measures. 

Cooperation and Information Sharing 

It promotes cooperation and information sharing among member states and between the public and private sectors to enhance collective cyber security defense. 

These are the main reasons for the second version of NIS (NIS2) coming in October 2024:

• Evolving cyber threat landscape
• Increased dependency on digital
• infrastructure
• Technological advancements
• Lessons learned from NIS1
• Harmonization and consistency implementation
• Expansion of scope
• Alignment with other EU legislation
  International cooperation

To summarize, the news in NIS2 is the following:

• More entities (industries) and sectors are covered.
• New methods of selection and registration.
• New incident notification deadlines.
• Greater accountability for management and personal responsibility.
• Introduction of sanctions, like those included in GDPR.
• Mandatory incident reports, also for so-called ”near misses”. 

The NIS2 Directive is set to be put into applicable national law by all EU member states by 17 October 2024. This is a crucial date for businesses to take note of as failure to comply with the directive can result in severe consequences such as financial penalties and damage to reputation. So, companies must gear up and prepare to ensure full compliance well before the deadline. Be sure to act now to avoid any potential negative consequences. 

The NIS2 directive takes a nuanced approach to administrative fines, differentiating between the Essential and Important Entities. 

Essential Entities
A maximum of at least 10,000,000 EUR or up to 2% of the total worldwide annual turnover of the undertaking to which the organization belongs in the preceding financial year, whichever is higher. 

Important Entities 
A maximum of at least 7,000,000 EUR or 1,4% of the total worldwide annual turnover of the undertaking to which the organization belongs in the preceding financial year, whichever is higher. 

Implementing risk-based cyber security practices is one of the most important areas of NIS and NIS2.  Holm Security helps organizations that must comply with NIS and NIS2 within several key areas: 

• Perform automated and continuous (systematic) risk assessments.
• Create a proactive approach towards cyber security
• Implement basic cyber hygiene practices and cyber security training.
• Provide the tools needed to secure the supply chain.
• Help management supervise the implementation of risk management.
• Demonstrate compliance based on data and reports. 

Referring to the requirements stated by EU and local authorities, vulnerability scanning or security scanning is a requirement as a part of the key element: risk assessment. For instance, The National Cyber Security Centre (NCSC) of Ireland and The Swedish Civil Contingencies Agency (MSB) both refer to vulnerability management as a critical element in compliance with the NIS2 Directive.  

One of the focus areas of NIS2 is about securing the supply chain. This means that you will have to make sure not only that your organization is secure but also that your suppliers. In other words, you will have a responsibility to secure the entire supply chain. We’re happy to tell you more about our solutions for securing your supply chain. 

As a supplier to an organization that must comply with NIS/NIS2, you must ensure that you fulfill more or less the exact security requirements. Even if NIS2 will not hit your organization directly, you must still comply. Contact us to discuss how we can help you become ready to meet the future NIS2 requirements for the supply chain.