NIS2 and now? Practical tools

In this blog we provide important practical guidance for the implementation of the NIS2 guideline. This directive introduces enhanced cybersecurity requirements for a wide range of sectors and companies within the EU. This requires a critical assessment and adjustment of current security practices and management policies of organizations. Although the Dutch elaboration of the NIS2 is not there yet, nor is the effective date known, you can already make preparations.

Impact on management

A crucial element of NIS2 is the impact on the management level of organizations. The directive requires executives to be actively involved in cybersecurity and take responsibility for the security of their information systems. This includes ensuring adequate resources and implementing an information security management system (ISMS).

Understanding the chain

NIS2 emphasizes the importance of understanding the supply chain, holding organizations accountable for the security of their entire chain, including suppliers and partners. Hackers who target large companies often first attack small companies that are in connection with those large companies. This undermines the chain and affects both large and small companies.

Duty of Care, Duty to Report and Supervision

The duty of care under NIS2 means that organizations must take appropriate technical and organizational measures to manage the risks to their network and information systems. This requires continuous risk analysis and taking preventive measures. The reporting obligation requires organizations to report serious incidents to the relevant national authorities within 24 hours. Compliance monitoring under NIS2 is strengthened, with the possibility of audits and inspections by regulators.

Become demonstrably compliant

To become demonstrably compliant with NIS2, we advise organizations to implement an ISMS based on recognized standards such as the ISO 27001 or the NEN 7510 part 1. Implementing an ISMS provides a structured and cyclical framework for managing these risks and demonstrating compliance. An effective ISMS includes policies, procedures and proper organizational embedding of measures and controls, and this system should be regularly audited to ensure compliance. Performing a gap analysis to determine where the organization stands in relation to NIS2 requirements is an essential first step. Plans should then be developed and implemented to address any deficiencies in the control measures.

Requirements for management measures

The control measures required under NIS2 must be based on a risk assessment and must protect the availability, integrity, and confidentiality (AIC) of data. To work effectively and efficiently, we recommend relying primarily on standards that include control measures, such as ISO 27002, NEN 7510 Part 2, or the Government Information Security Baseline (BIO). Organizations must reevaluate and adapt their existing cybersecurity practices to meet the new requirements. This includes, for example, conducting risk assessments, updating incident response plans, and ensuring the continuity of critical services. The Perium platform gives organizations a head start, beginning with a gap analysis to assess the current state of cybersecurity measures and identify areas for improvement.

The importance of understanding the overlap between NIS2 and other standards

Organizations that already comply with ISO 27001/2, NEN 7510, or the BIO will find that there is significant overlap with the NIS2 requirements. It’s important to understand this overlap and take advantage of it to avoid duplicating efforts. In the Perium platform , this overlap has already been mapped out to help you get off to a flying start.

Key measures explained

The NIS2 lists the following topics for which organizations must implement appropriate measures:

1. Risicomanagement Breng je digitale risico’s in kaart en beoordeel deze regelmatig. Met de risicobeoordelingen kun je onderbouwde beslissingen nemen op welke beheersmaatregelen je in gaat zetten.
2. Bedrijfscontinuïteit Op basis van je risicobeoordeling en eisen voor continuïteit maak je een continuïteitsplan en test je deze regelmatig.
3. Veiligheid in de keten Beoordeel de veiligheid van je ketenpartners om potentiële risico’s van externe leveranciers en dienstverleners te identificeren. Neem passende maatregelen om je bedrijfscontinuïteit te garanderen.
4. Beveiliging van netwerk- en informatiesystemen Ga aan de slag met een uitgebreide aanpak voor de beveiliging van netwerk- en informatiesystemen, waarbij systemen goed zijn ingericht en er een doeltreffend beleid is voor het identificeren en omgaan met kwetsbaarheden.
5. Cyberveiligheidsbeleid Zorg voor een duidelijk informatiebeveiligingsbeleid en dat de medewerkers hiervan op de hoogte zijn en deze wordt nageleefd.
6. Effectiveness of cybersecurity measures Regularly assess the effectiveness of your management measures, allowing you to make appropriate improvements.
7. Cryptography and encryption implementation Ensure properly secured and correctly encrypted connections.
8. Physical security Implement physical security measures, including policies related to personnel, access control and asset management.
9. Multifactor authentication Deploy multifactor authentication (MFA) for relevant accounts, including those accessible from the Internet and with management rights to critical systems. This will help you best protect your organization from cybercriminals.

Above all, make use of the control measures already available in the standards mentioned above.

Proactive penalty policy

NIS2 is going to have quite an impact. Not complying with it means a risk of a hefty fine because of strict enforcement through proactive and regular inspections. Not after reports or incidents but in advance. After all, the importance is great. Among other things, our nuclear power plants, water supply and hospitals must remain safe. Everyone who supplies them must cooperate - and so must all companies in that chain.

Conclusion

For organizations, NIS2 means they must expand their approach to information security, with a strong focus on management responsibility, risk management, supply chain visibility, and demonstrable adherence to proven standards. With the Perium platform , you can quickly make the necessary preparations because NIS2 and the proven standards—including insight into their overlap—are already available. In addition, Perium provides you with a reliable ISMS, including risk management, with templates and a robust automated control function (PDCA). This ensures that the right actions are taken by the right people at the right time.