NIS2 Directive: What Entities Need to Know about Compliance? – Complete Guide & Real Case Studies

Sep 25, 2023 | Cybersecurity Compliance

Delve into the intricacies of NIS2 Directive through this detailed guide. Covering its origins, requirements, and impact on cybersecurity, this guide provides the necessary knowledge and tools to navigate the fast-paced world of data protection and risk identification efficiently.

Table of contents:

1. Introduction: The Importance of Understanding the NIS2 Directive

The NIS2 Directive is a crucial EU regulation focused on enhancing network and information system security, in line with the rapid digital transformation and threat landscape. With cyberattacks 38% increased by 2022 (Check Point Researh), it’s imperative for entities to navigate, comprehend, and comply with NIS2 requirements. It brings forth a new set of rules and compliance expectations that every applicable entity must meet.

Non-compliance risks significant financial losses, as cybersecurity incidents average a cost of $4.45M (IBM Cost of a Data Breach Report 2023). Do you know how to calculate the cost of a data breach?, check it here. Combining industry-specific terminology and expertise in data security and risk identification, our guide will help you stay informed and prepared, ultimately reinforcing your defense against rising cyber threats and ensuring regulatory compliance. Check our comprehensive guide for CISOs with strategies and ways to stay ahead of evolving threats.

2. What is the NIS2 Directive?

2.1 Background and Origin

The NIS2 Directive builds on the groundwork laid by NIS1, its precursor, trailblazing the course for robust cybersecurity regulation throughout the European Union. With the advancements in technology and data-oriented operations, an observed increase in the complexity of cyber operations is significant. This paradigm shift has led to a heightened interconnectivity of digital systems, advancing far beyond the perimeters established during the inception of NIS1.

NIS2 was instigated as a regulatory response to address this evolved cybersecurity arena. Recognizing the expanding digital infrastructure in every critical sector, the EU initiated this regulation to meet contemporary challenges and secure the digital landscape, consequently safeguarding economic and societal interests.

2.2 Goal and Purpose

The aim of NIS2 is to provide a higher common level of cybersecurity across the EU, considering the vital importance of network and information systems for our economies and societies. The directive encapsulates procedures spanning risk management, incident handling, and supply chain security. Through reinforcing resilience against cybersecurity threats, it seeks to shield the Internal Market’s smooth functioning and EU’s digital autonomy.

2.3 Effective Date

The NIS2 Directive is under the process of implementation, with deadlines highlighting the urgency in complying with the new requirements. As of now, the specific dates for NIS2 compliance have not been provided, are likely to apply as of October 2024, but it is crucial for organizations to keep a tab on updates as they are announced.

In fact, the DORA Regulation, which has key similarities to NIS2, has its effective date set on the 17th of January 2025, signaling that organizations must act promptly to adapt and concur with the guidelines.

To stay ahead of the game and avoid potential penalties, businesses should familiarize themselves with the NIS2 Directive, perform a gap analysis and continuously work on developing a strong cybersecurity foundation, matching NIS2’s stringent criteria. Given that preparation is vital, organizations ought to act promptly and diligently to mitigate risks, safeguard data, and protect themselves against cyber threats.

3. Who Does The NIS2 Directive Apply To?

The Network and Information Systems Directive 2 (NIS2) covers a broad scope of service providers and businesses in the EU, encompassing much more than its predecessor, the NIS Directive. It is integral for all those potentially affected to comprehend the implications and adjust their cybersecurity measures accordingly. This section will shed light on its application and give practical examples.

3.1 Operators of Essential Services (OES): Explained

An essential cog in the structured machine of the EU’s infrastructure is the Operators of Essential Services (OES). The NIS2 Directive broadens the definition and inclusion criteria of OES, and it now transcends sectors such as energy, transport, banking, financial market infrastructures, healthcare, drinking water supply, and digital infrastructure.

These entities must implement risk management measures appropriate to the risks that could impact the security of their network and information systems. Risk management includes employing effective cybersecurity protocols, regular system security checks, and mechanisms for incident reporting. Inspections on the operators will be at regular intervals to ascertain regulatory compliance.

To thrive in this new norm, OES within the EU will need to bolster their cybersecurity defenses, refine incident response plans, and foster a forward-thinking, cybersecurity culture. Check the best practices for incident response and recovery here.

3.2 Suppliers and Companies: Case Studies

Case Study 1: Transportation Company

Under the NIS2 directive, a trans-European transport company had to reassess its cybersecurity infrastructure. With a detailed risk assessment, the company discovered several vulnerabilities in their legacy systems. They upgraded their system, implemented tighter access management, and created a robust response plan against potential cybersecurity threats. With these changes, they ensured their compliance with the NIS2 Directive, fortifying their operational resilience.

Case Study 2: Energy Service Operator

A regional energy service operator in the EU was identified as an OES under the NIS2 directive. They undertook a gap analysis to figure out where their operations fell short of compliance. Consequently, they ramped up their data breach detection systems, reinforced their IT infrastructure, and regularly trained their staff on the latest cyber threat prevention methods. Their proactive actions enabled them not only to comply with the directive but also to be more equipped against potential cyber threats.

These cases underline how suppliers and companies mutably affected by the NIS2 Directive are proactively adapting to the shift in regulatory landscape, ensuring their business continuity and preserving the trust of their stakeholders in the process.

4. What Are The Requirements For NIS2 Compliance

Under the NIS2 directive, companies are mandated to meet a set of requirements. Achieving compliance calls for a holistic understanding of the directive’s components and tailoring processes accordingly. Let’s delve into these requirements.

One of the most important articles for centities to consider is the number 21, Cybersecurity risk-management measures. Essential and important entities shall ensure that they take measures to manage the risk and prevent the impact of incidents through:

  • Policies on risk analysis and information system security;
  • Incident handling;
  • Business continuity, such as backup management and disaster recovery, and crisis management;
  • Supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers;
  • Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure;
  • Policies and procedures to assess the effectiveness of cybersecurity risk-management measures;
  • Basic cyber hygiene practices and cybersecurity training;
  • Policies and procedures regarding the use of cryptography and, where appropriate, encryption. Check here an encryption guide for companies.;
  • Human resources security, access control policies and asset management;
  • The use of multi-factor authentication or continuous authentication solutions.

4.1 Risk Analysis and Information Security Policies

Organizations under NIS2 must conduct regular, deep-dive risk analysis sessions to evaluate the nature and level of threats confronting their technology and data, as it´s mentioned in the Article 21 “Cybersecurity risk-management measures”.

This robust risk analysis feeds into a comprehensive information security policy. The policy should articulate, in clear terms, how each risk will be managed and mitigated, serving as a road map for your organization’s risk management practices. In the Article 32, “Supervisory and enforcement measures in relation to essential entities”, states that countries shall ensure that the competent authorities, when exercising their supervisory tasks, have the power to subject those entities at least to:

  • On-site inspections and off-site supervision.
  • Regular and targeted security audits.
  • Ad hoc audits.
  • Security scans.
  • Requests for information including documented cybersecurity policies.
  • Requests for evidence of implementation of cybersecurity policies.

4.2 Incident Handling (Threat Response, Business Continuity, and Recovery).

The NIS2 directive mandates organizations to have a streamlined process for incident handling, covering everything from threat response to business continuity and recovery. This requires setting up clear procedures for detecting and managing threats, a rock-solid business continuity plan guiding actions during service disruptions, and a disaster recovery strategy outlining post-incident restorative actions.

4.3 Supply Chain Security (Managing Risks Across Business Partners and Suppliers, Secure IT Acquisition, Development, and Maintenance)

The NIS2 directive recognizes that your cybersecurity is only as strong as the weakest link in your supply chain. It necessitates the proper assessment and management of risks posed by partners and suppliers. Furthermore, it calls for secure procedures in acquiring, developing, and maintaining IT systems. Hence, enforcing clear contractual agreements regarding security compliance, regular security audits, and pushing for secure development practices throughout the supply chain are essential.

To navigate this maze of requirements effectively, organizations must diligently adopt a proactive stance, enhancing their cybersecurity measures, risk management practices, and quality assurance for compliance with the NIS2 Directive. Non-compliance isn’t an option.

5. Key Focus Areas for NIS2 Compliance

The road to NIS2 compliance poses its challenges. From a granular understanding of the directive to necessary infrastructural changes, the journey is far from straight. That being said, a few key focus areas can guide priority setting and resource allocation, making the ride smoother for organizations.

5.1 Cyber Strategy/Governance

In the NIS2 jigsaw puzzle, cyber strategy and governance serve as corner pieces. Bridging business goals with cybersecurity prerogatives drives the formation of a robust cyber strategy. Effective cyber governance then ensures this strategy is ingrained in the organization’s daily operations.

At the heart of this lies risk management, translating cyber threats into business risks, escalating it to the board level, and ensuring they are addressed in line with the organization’s risk appetite. The board also needs to disseminate a culture of cybersecurity, encouraging open dialogue about risks and countermeasures. Check how to create a Security-Conscious culture here.

The article 20, “Governance”, states that each country “shall ensure that the management bodies of essential and important entities approve the cybersecurity measures in order to comply with article 21, oversee its implementattion and can be held liable for infringements”.

It also says that countries “shall ensure the members of management bodies entities to offer similar training to their employees on a regular basis”. Here you can learn the most effective security awareness methods.

NIS2 mandates the execution of an overarching cyber risk governance framework, setting specific roles, responsibilities, and escalation pathways. For organizations, it’s a signal to enhance their cyber-spatial vigilance and to protect their operations and reputation.

5.2 Information Security Management

Information is the lifeblood of modern businesses, and NIS2 puts a spotlight on its secure management. Compliant organizations need to showcase effective procedures for information security, from encryption methods and secure channels for data transmission to periodic cybersecurity training for staff.

Regular risk assessments, bolstered by robust authentication protocols and access control, further enhance data security. Incident reporting procedures and effective response strategies form crucial aspects of this equation.

In essence, NIS2 pushes for a proactive stance on information security management, emphasizing preventive security measures over reactive ones, and calling for a significant shift in how organizations view information security. A shift from being a supportive function to being a strategic lever for business continuity and growth.

6. How to Prepare for the NIS2 Directive

Preparing for NIS2 is more than a regulatory mandate; it is a strategic move towards greater operational resilience. As the clock ticks towards its implementation, organizations must proactively get their elements in line to navigate the new landscape effectively.

6.1 Checklist, steps and Measures to Achieve Compliance

The road to NIS2 compliance begins with a strategic vision and culminates in well-planned tactical actions. Follow these steps to effectively tread on this journey:

  • 1. First, Understand the NIS2 Requirements: Begin by internalizing the nitty-gritty of the directive. Understanding requirements at an in-depth level will help you plan your compliance strategy better.
  • 2. Establish a Cross-functional Compliance Team: Construct a team with stakeholders from key areas of your organization. Compliance isn’t a siloed endeavor, but one that requires a multi-disciplinary approach.
  • 3. Conduct a Gap Analysis: Identify where your organization currently stands and where it needs to be in terms of NIS2 requirements. The aim is to highlight areas of vulnerability and non-compliance.
  • 4. Develop a Comprehensive Cyber Strategy and Governance Framework: Your strategy should focus on aligning cybersecurity measures with business objectives, while your governance framework establishes clear roles and escalation pathways.
  • 5. Implement Robust Information Security Management Practices: Enhance measures for data transmission security, encryption, strict access control, incident reporting procedures, and create potent response strategies.
  • 6. Enhance Supply Chain Security Measures: Adopt strict security compliance standards for partners or suppliers. Regular audits and secure IT procurement and development strategies will also be crucial.
  • 7. Test, Review, and Improve: Lastly, regularly test your systems, review the effectiveness of security measures, and take proactive steps to improve.

Preparations for NIS2 compliance necessitate a comprehensive and robust approach. Following these steps and measures helps equip organizations to effectively respond to the directive’s challenges, turning compliance from a box-ticking exercise to a strategic asset.

7. Leveraging SealPath for NIS2 Compliance & Information Security Measures

As the NIS2 Directive puts a stronger emphasis on the use of encryption and other proactive security measures, it’s indispensable for organizations to harness the power of versatile data protection solutions, such as SealPath.

7.1 SealPath: An easy to implement Solution for NIS2 Compliance

SealPath, with its advanced suite of data protection features, syncs seamlessly with the stringent requirements of the NIS2 Directive. This solution serves as a robust tool to streamline your organization’s journey towards comprehensive compliance.

Outstandingly, SealPath facilitates the encryption of data, an aspect explicitly mentioned in NIS2, inside the article 21. SealPath shields your sensitive data from unwarranted access, ensuring that you retain full control of your data wherever it travels.

Preventative measures are a significant part of the NIS2 requirements. SealPath’s dynamic data protection features, such as granular access rights, expiry dates, remote document deletion, and controlled access, offer an extra layer of security for your data and align directly with these measures. The ease of these features’ use can remarkably simplify the usually complex task of data protection and risk management.

The mechanism to facilitate secure file sharing offered by SealPath pairs perfectly with NIS2’s emphasis on secure channels for data transmission. Concurrently, the collaboration features ensure cross-platform compatibility for protected documents – a critical asset in today’s interconnected business landscape.

Thus, SealPath, with its multifaceted features, emerges as a powerful ally for organizations seeking NIS2 compliance. Embrace SealPath to navigate the ever-evolving data security landscape with confidence, and step into a secure digital future.

7.2 Data Security through the Supply Chain: Real Case Studies

Case Study 1: Multinational in the field of renewable energy

A global leader in renewable energy, tackled its data security challenges by leveraging SealPath’s robust solutions. They had a pressing need – secure sharing and control of their intellectual property documentation with remote technicians. Their primary goal was to efficiently share the company’s critical intellectual property documentation with external entities while still exerting complete access control over shared documents. Utilizing SealPath Sync feature, the organization ensured offline data security and control, even in remote locations with limited connectivity.

SealPath played a vital role in managing the identities and authentication of external users on the system. By adopting SealPath’s SaaS solution, the company gained security and operational efficiency without the need for complex infrastructure set-up. This case underscores how SealPath’s flexible and scalable solutions can be pivotal to ensure compliance with directives like NIS2 and underlines the pathway to enhanced cybersecurity through conscious, informed steps.

Case Study 2: Multinational company in the semiconductor industry

A multinational company in the semiconductor industry trusted SealPath’s data protection solutions to safeguard critical files and documents. Operating in a sector characterized by intricate supply chains and sensitive CAD files, the company sought an automatic and effective means to protect their confidential assets. Storing sensitive documents and CAD files on M365 SharePoint sites, the company ensured secure internal and external sharing. By implementing SealPath’s sophisticated automatic protection policies on sensitive folders, they ensured that every uploaded file was instantly secured.

This automatic provision safeguarded not just the files within their network, but also ensured that documents remained secure when downloaded by third parties. The system, equipped with SealPath, enabled real-time access revocation, allowing the company to instantly rescind access remotely. With the ability to track activity in real-time, the corporation efficiently maintained a superior level of control over its digital assets.

8. Conclusion: Staying Compliant in the Era of NIS2 Directive

The NIS2 Directive marks a new era in cybersecurity regulations, demanding businesses to adapt to its stringent measures and proactive security practices. Staying compliant with NIS2 isn’t simply a regulatory obligation but rather a strategic move for the long-term prosperity of organizations.

The pathway to compliance may seem daunting. However, by embracing the principles of cyber strategy, governance, and information security management, organizations can confidently march towards NIS2 compliance. Technology solutions, such as SealPath, can serve as a crucial ally in this process, streamlining data protection and complying with the directive’s prescriptions. The importance of adhering to NIS2 requirements cannot be stressed enough as it not only safeguards businesses and their customer’s data but also helps thrive in today’s digital landscape.

Our team at SealPath is dedicated to assisting you on your journey towards NIS2 compliance. We invite you to contact us for a complete, no-obligation consultation to discuss how our solutions can empower your organization in this new regulatory era. Prepare for a secure future by staying compliant and enhancing your business’s operational resilience with SealPath.