Key Takeaways
- NIS2 compliance mandates that companies operating within the directive’s ambit undertake proper risk management, incident reporting, and governance concerning cybersecurity.
- For NIS2 compliance, a checklist ought to include risk assessment, supply chain security, access control, business continuity, staff training, and proof.
- Companies need to evaluate their particular national implementing legislation, deadlines for reporting, and supervision requirements and cannot take a one-size-fits-all approach, as all EU member states have their own regulations.
Cybersecurity threats may result in disruption of crucial services and disclosure of confidential information and have an impact on the whole supply chain. The new directive—the NIS2 Directive—increases cybersecurity duties of organizations operating in critical sectors and provides for more specific requirements concerning accountability, risk management, and reporting incidents.
To meet these requirements, an organization needs to do much more than install security software. Compliance with NIS2 will assist organizations in identifying their obligations and security gaps.
What Is NIS2?
The Directive (EU) 2022/2555, or NIS2, is a piece of legislation in the European Union whose main objective is to ensure the attainment of a high degree of cybersecurity among the member states. This is an updated form of the Network and Information Security Directive.
The directive concerns the risks that affect networks, information systems, and services that support the European economy and society. It increases responsibilities regarding management, supply chain, reporting, and regulatory supervision.
Since NIS2 is a directive, its provisions have to be implemented in national legislation. Thus, it is necessary to take into account not only the directive but also the corresponding legislation in each respective country of the EU.
The framework distinguishes between essential entities. Although both categories face cybersecurity risk management obligations, their supervisory arrangements and potential penalties can differ.
The effective date for the NIS2 Directive is October 17, 2024. Companies should check their national requirements, as these may differ due to implementation and enforcement variations.
Scope of NIS2
NIS2's scope covers 18 sector groups as specified in the annexes of the directive. The scope includes sectors that are highly critical, as well as other critical sectors.
The sectors include energy, transport, banking, healthcare, drinking water, wastewater, digital infrastructures, ICT service management, public administration, and space. Other sectors covered include postal services, waste management, chemicals, food production, manufacturing, digital providers, and research.
Whether applicability applies to a particular organization depends on factors such as the sector it operates in, the size of the organization, the activities of the organization, and the circumstances of the organization. Large and medium-sized organizations in the covered sectors may come under the scope, while some organizations will fall within the scope regardless of the size of the organization due to the nature of their services.
Examples include a managed service provider that serves more than one business. In that case, the organization introduces cybersecurity risks to all its clients. Another example is a manufacturer that produces critical products even though it doesn't provide digital services.
Also Read: NIST AI Risk Management Framework: A Full Guide for Teams
NIS2 Requirements
The requirements of NIS2 outline a risk-based cybersecurity approach. According to Article 21, there are ten areas of cybersecurity risk management measures that the essential entity should consider using proper and proportional technical, operational, and organizational measures.
Governance and Risk Management
The management of the organization should ensure approval and implementation of the cybersecurity risk management measures. The members of management should be trained on cybersecurity.
Organizations need to define ownership, cybersecurity policies, risk assessments, and escalation procedures for significant issues. The cybersecurity measures should be included in the business governance.
Incident Handling and Reporting
Procedures for detecting, evaluating, managing, and reporting any significant incident must be put in place. According to Article 23, the reporting process is usually comprised of a warning notice issued within 24 hours of knowing about a significant incident, an incident notice within 72 hours, and a final report made within one month after the notice.
Any specific details or exemptions must be confirmed with the relevant national legislation. Procedures for handling incidents must specify the decision-making process, documentation of evidence, lines of communication, etc.
Business Continuity and Supply Chain Security
It is necessary for organizations to ensure that they consider business continuity, backup management, disaster recovery, and crisis management. The recovery process should be tested to check whether the critical services can be recovered within an acceptable period of time.
Supply chain security is equally crucial. Businesses need to evaluate the risk posed by the suppliers, consider access permissions, develop appropriate legal protection, and monitor critical service providers.
Technical and Organizational Safeguards
The risk management activities within the directive include security related to system acquisition and maintenance, handling vulnerabilities, effectiveness testing, cryptography when necessary, access control, asset management, and cybersecurity awareness.
Multifactor authentication, encryption, monitoring, and proper configuration could help in achieving these goals. Nevertheless, controls have to be chosen depending on risk factors and requirements, not considered a toolkit for all circumstances.
NIS2 Security Measures
NIS2 security measures involve technology, processes, and people. Usually, the implementation of just one security measure will not suffice in dealing with all potential dangers.
It is recommended to have a list of systems, information assets, services, and important suppliers in order to understand what needs to be protected. The principle of least privilege should apply to access controls by granting employees access only where necessary. Offboarding and access review procedures can also be useful here.
For vulnerability management, it is crucial to perform vulnerability identification and patching, as well as document decisions made during remediation efforts. For security monitoring, one should ensure that alerting is effective, and incident response plans should include investigation and mitigation processes.
Some additional methods may include encryption, authentication, backup protection, and network segmentation. Phishing and other social engineering, password policies, and incident reporting should be included in the employee awareness program.
The above-mentioned controls should be regularly reviewed, including vulnerability scans, recovery drills, penetration testing, and controls review.
NIS2 Compliance Checklist
The NIS2 compliance checklist converts the regulatory duties into feasible actions. Apply the below sections to evaluate your readiness, and tailor them to the specific national regulations that apply to your organization.
- Scope and registration: Determine if your organization falls under the essential entities category and its registration duties.
- Governance: Capture the management’s control, roles, approvals, and cybersecurity training.
- Risk assessments: Detect threats, vulnerabilities, critical information assets, and adequate response measures.
- Security controls: Evaluate your access controls, authentication methods, encryption, vulnerabilities, and network security.
- Incident Reporting: Set out your process for escalation, reporting, and deadlines for reporting significant incidents.
- Business Continuity: Ensure that you have backup and recovery processes that have been tested.
- Supplier Security: Assess your critical suppliers and identify any contractual security clauses.
- Evidence and Testing: Retain risk assessment records, policies, evidence of testing, incident logs, and remediation evidence.
Each of these sections needs to have an owner and a review period. The checklist should demonstrate whether there is complete implementation, partial implementation, or no implementation at all, together with the relevant evidence.
NIS2 Non-Compliance Penalties
Penalties for non-compliance with NIS2 will depend on the type of entity, the nature of the non-compliance, and the enforcement regime within the particular country.
As provided for under Article 34, national regulations are required to impose maximum administrative fines of at least €10 million or 2% of the yearly worldwide turnover of the entity in question, whichever is greater, in the case of specified violations of essential entities. The respective minimum maximum amounts for important entities are set at €7 million or 1.4% of yearly worldwide turnover, whichever is greater.
It should be noted that the above figures pertain to required maximum fine thresholds and do not represent automatic sanctions for any violation. Other potential penalties include compliance orders, instructions, supervision, or any other penalty allowed under national law. Management responsibility is another key factor.
Organizations can mitigate risks by timely identification of vulnerabilities and documentation of remediation actions, as well as prompt reporting of significant incidents.
Businesses can completely avoid these penalties by integrating Attestpath; it will automate the complete process and ensure the compliance rules are not breached.
Must Read: Compliance Controls: Types, Testing, and Best Practices
Conclusion
NIS2 compliance demands that businesses align their cybersecurity governance efforts with risk management, technical measures, and proof of implementation. Begin with a verification process of whether you need to comply, look at the national requirements, and evaluate your current controls against the obligations of the directive. Focus on closing critical gaps, enhance supplier control processes, perform disaster recovery and incident response tests, and keep responsibilities clear.
Frequently Asked Questions
Does NIS2 apply to organizations outside the European Union?
Those organizations that have been set up outside the EU could find themselves affected when their activities or services come under the directive's scope or when they have EU operations. They may also encounter contractual conditions imposed by EU clients.
Is ISO 27001 certification enough to meet NIS2 obligations?
No. While the ISO 27001 standard can be used as a good basis for managing information security, just having the certificate does not guarantee that all NIS2 requirements will be fulfilled.
How often should an organization review its cybersecurity controls?
The frequency of reviewing the controls depends on several factors, including risks and legal requirements. Controls should also be re-reviewed when a critical incident occurs, there is a change to the IT system or the supplier, and so on.
What evidence should organizations retain for NIS2 assessments?
Useful evidence includes risk assessments, approved policies, access reviews, security testing results, employee training records, incident documentation, supplier assessments, and remediation records. Evidence should demonstrate that controls operate effectively.
Can a third-party supplier create NIS2 compliance risks?
Yes. A supplier with access to systems, sensitive information, or critical services can introduce cybersecurity and operational risks. Organizations should assess relevant suppliers, establish appropriate contractual protections, monitor significant risks, and maintain contingency arrangements.
