Countdown to compliance: navigating the NIS2 directive

Thomas MacKenzie at Lansweeper explains the NIS2 directive and how companies can begin preparing for it

 

On October 17th, 2024, the EU’s new NIS2 directive will go into effect. By that date, each member state is responsible for translating the directive into national law. These laws will then need to be implemented by organisations in all so-called essential and important industries. 

 

What is NIS2?

Both the original Network and Information Security (NIS) Directive from 2016 and this new NIS2 iteration are EU-wide legislation meant to boost the overall cyber-security profile of the European Union. Through a series of cyber-security measures, the directive will strengthen member states’ individual cyber-security postures, improve incident response, and enhance international cooperation between member states.

 

The scope of NIS2 is significantly broader than that of the original NIS Directive from 2016. A number of industries - like postal and courier services, waste management, and many more - were added, and those that were already in scope have been expanded. NIS2 only applies to large or medium-sized organisations, though small and micro-entities that fall outside that scope are still encouraged to look to NIS2 as a guideline for robust cyber-security.

 

While NIS2 is an EU directive, organisations outside the EU that offer their services in the EU within the scope of NIS2 will still have to follow these rules as well.

 

The challenges of NIS2 compliance

When preparing to implement NIS2 in your organisation, a lot of challenges pop up. For one, the NIS2 directive itself is a high-level document, and the measures put forward in it are therefore quite general or even vague. We will have to wait for the national laws published by individual member states for a more actionable list of measures to be taken in order to become compliant. However, the directive can already serve as a general guideline of measures to be put in place.

 

Another factor that may complicate NIS2 compliance is the scale and complexity of the measures required. The directive is explicitly targeted to large and medium-sized organisations. Some of the requirements listed like risk management, cyber-hygiene, incident handling, or disaster response will require large-scale cooperation between various departments. Understanding and implementing these requirements can be complex, especially for organisations operating across multiple jurisdictions or sectors

 

With the directive going into effect in October, time is also of the essence. While audits and fines probably won’t be issued immediately on October 18th, there is still no time to lose. Some requirements will need a significant investment of time, budget, and skilled personnel. In many organisations, allocating the resources needed will take time.

 

One ongoing challenge will be to remain compliant. Securing a diverse and ever-evolving technology landscape is a challenge to begin with. Keeping it secure in the face of evolving cyber-threats even more so. NIS2 compliance will be an ongoing process that requires continuous monitoring, updates, and improvements to adapt to evolving cyber-threats and regulatory changes. Maintaining long-term compliance can strain organisational resources and commitment.

 

Preparing for NIS2 compliance

While we wait for the EU member states to translate the NIS2 Directive into national law, we can have a closer look at the directive itself to get an idea of what will be expected of us. By familiarising yourself with the provisions and requirements in NIS2, you can better understand how they apply to your company. Article 21 is perhaps the most concrete article in the NIS2 directive in terms of actionable items. While they remain high level, they give some idea of what is expected of the organisations in scope to achieve compliance. 

 

Once you have a better understanding of the directive, you can assess your current cyber-security measures, including policies, procedures, technical controls, and incident response capabilities. This way you can identify any gaps or areas for improvement in light of NIS2 requirements and start working on those.

 

Things to focus on are risk management, incident response, business continuity, access control, backup management, and encryption. But the directive also asks for policies regarding disaster recovery and crisis management, supply chain security, HR security, and cyber-hygiene and cyber-security training for all employees. Cyber-security is not just the responsibility of the cyber-security and IT teams. It should be a company-wide culture. 

 

Also, keep an eye out for any communication from your national government regarding NIS2. As the deadline approaches, more information will become available on how individual member states are shaping their laws. 

 

As the deadline approaches, the most important step we can take to prepare is to understand the directive’s requirements and implications. While the directive’s high-level nature may pose initial challenges, you can prepare by familiarising yourself with its provisions and assessing your current cyber-security measures. 

 

Collaboration across departments, ongoing monitoring, and a commitment to cyber-security culture will be essential for achieving and maintaining compliance. By taking proactive steps now, you will not only be prepared for compliance but also enhance your overall cyber-security resilience in an ever-evolving threat landscape.

 

---

 

Thomas MacKenzie is the Director of Product Strategy at Lansweeper

 

Main image courtesy of iStockPhoto.com and ericsphotography