NIS2 Directive: Ignorance can cost you

I recently discussed which organizations based in the EU fall under the scope of the new NIS2 directive in the blog article “NIS2: It's getting CRITICAL”. But the arc can also be drawn to my Star Wars series of articles. Let's put it this way: the building technology of the Death Star would definitely fall the new NIS2 directive. Today, however, we’re taking a more concrete look at the extent to which NIS2 goes beyond the previous regulations, what companies have to do, and what challenges await IT admins in the process.

One thing is clear: all affected companies are required to expand their activities in the areas of risk analysis, information security, measures assessment and implementation, incident response management, crisis management and training.

A central aspect in the broadest sense is cybersecurity. Particularly in times of a shortage of skilled workers, NIS2 implementation is a real challenge for many companies when even more manpower is now required for corporate security.

In concrete terms, this means that CRITIS companies must update their technical and organizational security measures in the area of incident management as well as their business continuity plans. They are also required to conduct regular risk assessments to provide additional safeguards for all potential points of entry. Just here again the keyword: Death Star.

Affected companies must present effective concepts for risk analysis and also evaluate in them how effective which measures are. In addition, there must be regular training in the area of cyber security. Not to be forgotten: supply chain security, asset management and even personnel security fall under NIS2.

Here – and this is important for affected companies – the security measures required are not based on the cybersecurity costs invested, but primarily on the potential impact. For example, some affected CRITIS companies must register with the European Union Agency for Cyber Security (ENISA) and usually report security incidents in several stages:

• Initial report within 24 hours
• Update of this initial report within 72 hours
• Final report to the BSI within one month

So it is now becoming really critical for CRITIS companies and they urgently need to take security measures to better protect themselves against threats. At the same time, existing budget and, above all, personnel limits must be taken into account. In doing so, it pays off relatively quickly to invest in defense and recovery measures.

The fact is that complying with NIS2 requirements makes sense for companies overall, because it significantly reduces the risk of cyberattacks. Last but not least, companies also benefit from improved efficiency and productivity.