NIS2, an extension to NIS1

Cyber threats have increased significantly in recent years. In addition, our society is increasingly dependent on digital infrastructure. The European Commission found that there is still a lot of uncertainty in the field of information security: what measures should organizations comply with, who is responsible, what is the scope and how is it enforced? Time for a new measure that brings everything into focus. The NIS2 is a successor to the NIS1. The latter has been in force since 2016 and enshrined in the Netherlands in the Network and Information Systems Security Act (Wbn). Although there are similarities between the NIS1 and NIS2, the NIS2 has a much greater impact than its predecessor. This is partly because the NIS2 applies to more sectors, the security requirements have been expanded and management is more involved in network and information systems security. The changes in outline are:

• The new legislation applies to more sectors
• Security requirements have been expanded
• Managers and Boards become more involved and can be held responsible as well as accountable
• Sanctions and supervisory powers of competent authorities strengthened
• Failure to comply with the NIS directive can lead to fines and penalties
• Incident reporting obligations have been clarified
• The security of the chain of which the organization is a part receives more attention

NIS2 only applicable to the vital sector?

The NIS2 regulations do not apply to all companies and organizations, but are limited to the vital sector. This sector includes organizations and companies that play a crucial role in our society, so the importance of the NIS2 regulations is very high. Organizations that belong to the vital sector are:

• Energy
• Transportation
• Banking
• Infrastructure of financial markets
• Healthcare (including laboratories, research and medical equipment)
• Drinking water and wastewater
• Digital infrastructure
• Digital services
• Space
• Postal and courier services
• Waste Management
• Chemistry
• Food
• Industry (mainly medical, computer and transportation equipment)

It is important to keep in mind that the NIS2 directive does not only apply to these organizations, but also to the entire chain of these organizations. The regulations therefore also apply to partners, suppliers and service providers of that vital sector. It is important that everyone in the entire chain understands their responsibilities and takes the necessary measures to keep the security of the vital sector high. After all, the chain is only as strong as its weakest link.

From risk scan to encryption: what measures should you consider?

In essence, organizations covered by the NIS2 directive must secure their network and information systems against cyber attacks and other security risks. In doing so, they must first identify and evaluate their network and information systems. This is how to determine which systems are critical and where additional security is needed. Then, based on this risk analysis, appropriate security measures are taken. Management should also be well aware of liability and additional responsibilities. Finally, organizations should ensure long-term security and conduct risk assessment on a regular basis. An overview of some of the measures organizations can take is shown in the NIS2 Article 18(2):

• Incident handling
• Business continuity and crisis management
• Supply chain security
• Security in acquiring, developing and maintaining network and information systems
• Policies and procedures (pen testing and auditing) to assess the effectiveness of cyber security risk management measures
• The use of cryptography and encryption

Who is responsible for what?

Most organizations have an officer whose role is information security; the Security Officer or CISO. Given his or her knowledge in this area, it is obvious to place the implementation of these measures in the hands of this person, yet the ultimate responsibility lies with management and the board. They are responsible for ensuring compliance with the guidelines and implementing appropriate security measures within the organization. Above all, information security and privacy concerns all employees. So place ownership for risks and control measures where it belongs and ensure that everyone in the organization has the necessary cybersecurity knowledge appropriate to their role.

Failure to comply with NIS2 has major consequences

Failure to comply with the NIS2 can result in fines, penalties and damage to reputation. The exact penalties for a board member and/or executive who fails to comply with the law depend on the situation, specific provisions and the national legislation of the member state where the company is located. A legal game changer with the NIS2 is that these regulations can now also hold responsible parties liable in case of gross negligence. Think of management positions or directors. Customers or partners can also take legal action more easily. Furthermore, it goes without saying that not complying with the NIS2 has a negative effect on the organization's image. Of course, you do not want to be known as an organization that does not take information security seriously.

From regulation to practice, our concrete tools will get you started

It’s not always clear exactly what measures you need to implement. Based on your risk analysis, you must take “appropriate measures.” But what is appropriate? And how do you avoid overlooking certain issues and still facing legal consequences? NIS2: From Regulation to Practice. Three renowned cybersecurity firms offer concrete guidance on complying with the NIS2 guidelines. During a webinar on June 8, 2023, Brand Compliance, Hacksclusive, and Perium shared their expertise on security governance and periodic penetration testing as measures for a coherent NIS2 approach.