EU tightens the NIS (Network and Information Systems) Directive. Do you comply with new requirements?

EU tightens the NIS

As we mentioned in a previous blog, countries around the world, and predominantly US, UK and EU have been tightening their cyber security regulations to combat ever increasing and sophisticated cyber-attacks targeting critical infrastructures, businesses, and digital service providers. In this endeavour, EU updated its NIS directive, which was initially released in 2016, on 16th January 2023 as NIS2. Member states now need to transpose its measures into national law until 17 October 2024.

The NIS2 Directive is a significant component of cybersecurity legislation. The European Union introduced the Directive to improve the cybersecurity of critical infrastructure systems within its member states and to ensure that digital service providers and operators of essential services have adequate security measures in place to secure their networks and data.

In Sweden, the NIS2 Directive is implemented via the Information Security Law (Sakerhetsskyddslagen).  The NIS2 Directive mandates that Essential Entities (EE) and Important Entities (IE) have cyber security procedures, including risk assessments, incident management, and security testing. In addition, businesses must have adequate policies and procedures in place to ensure a rapid, effective response to cybersecurity issues including corporate accountability and timely reporting of incidents.

These overarching requirements can be expanded upon at a more technical level to address certain types of cyber threats more specifically like the use of multi-factor authentication, the use of encryption, and cyber security testing or secure development practices etc.

Essential Entities (EE) and Important Entities (IE) include a wide range of organisations that can be digital service providers or operators of critical infrastructure. Businesses that provide online markets, cloud computing services are digital service providers. Operators of critical national infrastructure include providers of energy, transportation, healthcare, potable water, and digital infrastructure.

Digital service providers and operators of essential services are required by the NIS2 Directive to maintain an adequate level of cybersecurity. This necessitates that firms implement stringent security measures to safeguard their networks and data from cyber-attacks.  The NIS2 mandate also requires enterprises to report cybersecurity issues, which is a crucial element. If an organisation has a severe cyber security event, they must disclose it to the appropriate authorities within 24 hours. Significant penalties may be imposed for failing to report an incident.

The Swedish Post and Telecom Authority (PTS) is responsible for ensuring NIS2 Directive compliance. The authority has the jurisdiction to investigate businesses that do not comply with legal requirements and, if necessary, to impose fines and other penalties.

Noncompliance with the NIS2 Directive may result in severe penalties. Companies that lack adequate security measures or neglect to report cybersecurity events are subject to fines of up to 10 million Swedish Krona or 2% of the global annual turnover. Repeat offenders may be subject to greater fines and possible legal action.  Additionally in some extreme cases managers can face temporary bans from holding similar positions.

In conclusion, the NIS2 Directive mandates the use of a variety of risk management practises to maintain the security and resilience of critical infrastructure systems. Organisations can protect their networks and data from cyber threats and contribute to the overall cyber security of critical infrastructure systems by identifying their assets, conducting risk assessments, implementing appropriate security measures, and developing incident management procedures along with business continuity plans.

The real call to action here is to ensure that your organization is equipped to defend against evolving cyber risks and be able to conform to the numerous regulatory and Government compliance requirements, it is paramount that your board and senior leadership teams assist in defining or enhancing your cyber security strategy. This will provide the appropriate level of focus and impetus enabling your organisation to adapt and evolve with the emerging threat landscape and improve your overall security posture.

Organisations affected by the NIS2 Directive often struggle with the complexities of defining the processes and procedures or deploying the technologies to comply with the requirements.  In some cases, organisation simply do not have the time, budget or resource to lay the groundwork.  For these organisations we have put together a simple step by step outline of how to get started, for more detailed assistance please contact the Cynode team.

 

References:

European Union Cybersecurity Agency (ENISA). (2020). Directive on Network and Information Systems (NIS). Taken from https://www.enisa.europa.eu/topics/nis-directive

Post and Telecom Authority of Sweden (PTS) (2020). Directive NIS. Obtainable at https://www.pts.se/en/industry/cybersecurity/nis-directive

Post and Telecom Authority of Sweden (PTS) (2020). Information Security Act (Information Security Act) Taken from https://www.pts.se/en/industry/cybersecurity/information-security-law/

https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32022L2555&from=EN

Please fill out the form or give us a call