Artificial intelligence (AI) has rapidly advanced over the last decade to a point where it can now outperform humans at tasks such as reading comprehension and image recognition.
NIS2
The Network and Information Systems Directive (NIS1) has been in effect across Europe since May 2018. Although NIS1 certainly helped secure networks across the European Union (EU), its limitations—including only covering a small set of organizations, allowing member states to implement varying levels of security postures, and permitting organizations to underreport incidents due to insufficient requirements—weakened its overall ability to secure and protect members.
As a result, the new and improved NIS2 passed in October 2024 with the aim of raising the baseline of security standards from the foundation of NIS1. While the directive contains extensive details, this article will provide you with a brief overview of what you need to know.
NIS2 Expertise
Cybersecurity Risk Assessment
Conducting thorough risk assessments to identify vulnerabilities in network and information systems
Regular Cybersecurity Audits and Reviews
Conducting periodic audits and reviews to evaluate the effectiveness of cybersecurity measures
Cybersecurity Policy Development
Developing and enforcing policies for assessing the effectiveness of cybersecurity risk management
Business Continuity Planning
Developing and maintaining plans for business continuity, including backup management and disaster recovery processes
Data Protection and Privacy Compliance
Ensuring compliance with data protection and privacy regulations, in alignment with cybersecurity measures
Who must comply with NIS2?
NIS2 expands the radius of companies in scope for this security directive outside of the EU to include any company that operates in or provides services to the EU within certain key business sectors. For example, a US-based cloud services provider with customers in the EU would need to comply with the directive.
And it is this change in scope that provides one of the biggest evolutionary shifts from NIS1 to NIS2. Where NIS1 covered only 7 critical sectors, NIS2 covers 18 total sectors classified as Essential Entities and Important Entities—meaning more third-party suppliers will fall under this scope. Below is a breakdown of the different sectors that will now fall under NIS2.
Essential entities
250 employees or more than €50 million in revenue.
Important entities
- Energy
- Health
- Transport
- Drinking Water
- Financial Markets
- Digital Infrastructure
- Banking
50 – 249 employees or more than €10 million in revenue.
- Public Admin
- Space
- Waste Water
- Digital Providers
- Postal Services
- Chemical Production
- Manufacturing
- Research
- Waste Management
- Food Production
Risk Management
As a result of the increase in scope, member states must ensure that essential and important entities implement appropriate measures to manage risks to the security of their network and information systems. These measures would include policies for risk analysis, incident handling, business continuity, and even specific details about implementing multi-factor authentication (MFA) on critical systems.
This responsibility to adapt now falls to senior management to approve these risk management measures, as the directive states that these decision makers may be held liable if there are any infringements of Article 21.
Incident Reporting Timeframe
One of the major components in Risk Management include updates to the incident reporting standards organizations must follow. Previously, NIS1 required reporting significant incidents within a wide span of 72 hours. Article 23 of the new directive, however, breaks reporting into 3 phases.
The first phase of incident reporting mandates that organizations issue an initial alert within 24 hours of detecting a significant incident, ensuring that relevant authorities are promptly notified.
The second phase involves submitting a comprehensive incident report within 72 hours, providing detailed information about the incident’s nature, impact, and any mitigation measures taken.
The final phase requires that at the one-month mark, a final report be developed detailing the incident’s impact, the measures taken to mitigate it, and any lessons learned to prevent future occurrences.
Penalities
The penalties for non-compliance have gotten stricter as well. If an organization were to be found non-compliant with the directive, it could face hefty fines. An Essential Entity can be penalized up to €10 million or 2% of their total worldwide annual revenue, while an Important Entity could be penalized up to €7 million or 1.4% of their revenue—an additional incentive that organizations stay in compliance with the directive.
Implementation
- Development and Maintenance of Cybersecurity Frameworks : Creating and updating frameworks for managing cybersecurity crises and incidents. Training and Awareness Programs: Conducting regular cybersecurity training and awareness programs for staff at all levels. Implementation of Security Measures: Ensuring the adoption and implementation of appropriate security measures, including elements like multi-factor authentication, to prevent or minimize the impact of cyber incidents. Cross-border and Cross-sectoral Cooperation: Facilitating cooperation within and across sectors and borders, especially in information sharing and response coordination
Management And Reporting
Vulnerability Management and Reporting: Detecting, reporting and managing vulnerabilities, including maintaining an anonymous reporting process Incident Response and Reporting: Establishing and executing incident response plans, including timely reporting of significant incidents to designated authorities Monitoring and Analysis of Cyber Threats: Continuously monitoring and analyzing cyber threats and incidents, disseminating information about these threats Supply Chain Security Management: Securing the supply chain, including evaluating the cybersecurity practices of suppliers and service providers
Supervision
NIS 2 empowers supervisory authorities in EU member states with enforcement capabilities to regulate cybersecurity and information security across both private and government entities. The following supervisory measures are introduced for essential and important entities:
Essential: ex-ante and ex-post supervision, onsite inspections and offsite supervision, regular and targeted security audits, security scans and information requests, and ad hoc audits.
Important: ex-post supervision, onsite inspections and offsite ex-post supervision, targeted security audits, security scans and information requests.
How Zaviant Can Help
Zaviant serves as a trusted NIS2 compliance partner for some of the world’s largest companies. We can help your organization:
Cybersecurity Risk Assessment
Regular Cybersecurity Audits and Reviews
Cybersecurity Policy Development
Business Continuity Planning
Data Protection and Privacy Compliance
Related Services
CCPA/CPRA
We tailor strategies to your unique risks and compliance needs, ensuring robust protection against cyber threats.
ISO 27001/2
As organizations continue to navigate the complexities of an increasingly interconnected digital world,.
NIST CSF
In 2013, the National Institute of Standards and Technology (NIST) added a Cybersecurity Framework, known as NIST CSF.
Trusted by Leaders of Industry
Our team of expert consultants works closely with Fortune 500 companies, mid-market businesses, and not-for-profit organizations spanning industries including retail, manufacturing, finance, technology, and more.
