It’s no news that the amount of cybercrime has been significantly increasing all over the world – specifically in Europe. That’s why the Network and Information Systems (NIS) Directive was published, back in July 2016, paving the way to improve the overall level of cybersecurity in the European Union (EU).


Building on that first ever EU-wide legislation on cybersecurity, NIS 2 came into force in December 2022 to strengthen cybersecurity within the EU, bringing forward a comprehensive set of measures whose adoption by EU member states is mandatory by 17th October 2024.


To ensure compliance and avoid unnecessary fines, now is the time for organisations to prepare themselves for the NIS 2 measures. Here’s everything they need to know.

 

 

What is the NIS 2 Directive?

It’s the most comprehensive EU cybersecurity legislation to this day. It aims to establish guidelines for organisations that provide essential and important services, so they know how to respond in the event of a cyber threat. It also intends to improve collaboration between EU member states when it comes to cybersecurity matters.


Under the NIS 2 Directive, organisations should implement, at least, the following measures:

  • Policies on risk analysis and information system security.
  • Incident handling.
  • Business continuity.
  • Supply chain security.
  • Basic cyber hygiene practices and cybersecurity training.
  • Procedures regarding the use of cryptography and encryption.
  • Human resources security, access control policies and asset management.
  • Use of Multi-Factor Authentication (MFA), continuous authentication solutions, and secure communication systems.
  • Among others.

 

 

Which sectors are impacted?

Approximately 160.000 companies across 18 sectors will have to comply with the NIS 2 Directive – basically, all medium or large businesses, with 50 or more employees as well as over €10 million in turnover. However, some smaller organisations can be included as well, regardless of their size, if they are identified by Member States as key players in our society.


Those 18 sectors are divided into two categories:

 

NIS 2 essential sectors
  • Energy (includes electricity, oil, gas, hydrogen)
  • Transport (includes air, rail, water, and road operators)
  • Banking
  • Financial market infrastructures
  • Health
  • Drinking water
  • Waste water
  • Digital infrastructure
  • Information and Communication Technology (ICT) Service Management (Business-to-Business – B2B)
  • Public Administration
  • Space

NIS 2 important sectors
  • Postal and courier services
  • Waste management
  • Manufacture, production, and distribution of chemicals
  • Production, processing, and distribution of food
  • Manufacturing (includes medical devices, computers, electronics, machinery, motor vehicles, among others)
  • Digital providers (includes social platforms, search engines, and online marketplaces)
  • Research organisations

Entities in both categories will have to comply, but the difference is in how strictly they are supervised, and in the penalties for non-compliance:

  • Essential entities can expect fines of up to €10 million or at least 2% of the total annual worldwide turnover.
  • Important entities can expect fines of up to €7 million or at least 1.4% of the total annual worldwide turnover.

 

 

Next steps and NIS 2 deadlines

In order to prepare for the NIS 2 Directive, member states and businesses should be aware of what will happen and when. These are some of the most important dates to keep in mind:

  • By 17th October 2024
    Member states must adopt the necessary measures to comply with the NIS 2 Directive. Those measures should be applied from 18th October 2024.

  • By 17th April 2025
    Member states shall establish a list of essential and important entities. This list should be updated on a regular basis.

  • By 17th October 2027
    The European Commission shall review the functioning of the NIS 2 Directive and report to the European Parliament and to the Council. This review must be done every 36 months thereafter.

 

How can companies prepare for NIS 2?

Given the 17th October 2024 deadline, it is advisable to act now. There may be bumps in the road, so planning ahead will keep you on the right track.


The upside is: if your organisation is already ISO 27001 certified, then it’s significantly closer to NIS 2 compliance. As for what’s missing, Alter Solutions can help identify your company’s critical services and processes, ensuring proper implementation of all the NIS 2 measures. How?

  • Assess and diagnose
    We start by identifying your company’s essential services and processes, to understand how the NIS 2 Directive will impact them. We provide a full report and define a roadmap with specific measures to ensure NIS 2 compliance.

  • Implement necessary measures
    We can help you define risk management policies, a business continuity plan, secure communication channels, cybersecurity training, among other things that may need to be addressed. We initiate implementation, taking your company’s specific security level into account.

  • Monitor regularly
    At this point, your company is already NIS 2 compliant. Nonetheless, it is important to regularly check the effectiveness of all the implemented measures and to adjust accordingly. This is an ongoing task with which we provide all the support you need.

 

Find out more about Alter Solutions’ services like Cybersecurity Management, Architecture and solutions integration, Audit & Pentesting, and Cyberdefence.
Compartir artículo