NIS2 Directive Overview: Key Points

• NIS2 aims to improve cybersecurity across the EU and promote cooperation.
• It now covers more sectors, including public services, waste management, and medical devices.
• Stricter rules require risk management, incident reporting, and regular security audits.
• Fines can be up to €10 million or 2% of yearly income.
• Companies must strengthen their security to comply with the rules and avoid penalties.

What Is the NIS2 Directive?

The NIS2 Directive, also known as the "Directive on Measures to Ensure a High Common Level of Cybersecurity in the Union," builds on an earlier rule from 2016 called the NIS Directive.

It was approved by the Council of the European Union on November 28, 2022, and officially took effect on January 16, 2023.

The NIS2 Directive expands cybersecurity rules to cover more businesses and industries.

It also makes security and reporting requirements stricter, standardizes penalties across all EU countries, and improves cooperation among EU Member States.

The main goal is to protect critical computer networks and systems in the EU from cyberattacks.

Key Elements of the NIS2 Directive

Expanding the Scope of Application

The NIS2 Directive now applies to more types of businesses compared to the old NIS Directive.

Some of the new sectors it covers include:

• Public Administration
• Spaceflight
• Waste Management
• Food Production and Distribution
• Postal Services
• Chemical Industry
• Medical Devices
• Electronics

Medium-sized and large companies in already covered sectors, such as energy, transport, banking, health, drinking water, and digital infrastructure, are also affected.

The goal is to make sure that key companies and organizations that are important to society and the economy have strong cybersecurity measures in place.

Stricter Security and Reporting Requirements

The NIS2 Directive brings in stricter rules to ensure companies are better protected from cyber threats.

These new rules include:

• Implementing risk management measures.
• Using secure network and information systems.
• Reporting security incidents within 24 hours.
• Conducting safety audits and penetration tests.
• Training employees and raising awareness about cybersecurity.

Companies must also prove that they have taken proper steps to protect their systems and data.

This includes using multifactor authentication, encryption, and regular security updates.

Standardized Penalties and Fines

To make sure all companies across the EU follow the same rules and remain competitive, the NIS2 Directive sets common penalties and fines for breaking cybersecurity requirements.

Fines can reach up to 10 million euros or 2% of a company’s yearly global income, whichever is higher.

Strengthening Collaboration and Coordination

The NIS2 Directive aims to get EU countries to work together more on cybersecurity.

This includes:

• Sharing information and best practices through the NIS Cooperation Group.
• Working together on cross-border security issues through the CSIRT (Computer Security Incident Response Teams) network.
• Conducting joint exercises and training sessions.
• Receiving support from the European Union Agency for Cybersecurity (ENISA).

This teamwork is meant to help the EU respond faster and more effectively to cyberattacks.

Impacts on Companies

The NIS2 Directive gives companies new responsibilities.

To meet these requirements and improve IT security, companies need to:

• Improve and document their risk management processes.
• Develop and test plans for how to respond to incidents.
• Report security incidents and cooperate with authorities.
• Review and update their IT systems and processes.
• Invest in cybersecurity measures and employee training.

These requirements can be costly, especially for smaller companies, but better cybersecurity also has significant benefits, such as:

• Gaining trust from customers and business partners.
• Protecting against financial losses from cyberattacks.
• Standing out by having high safety standards.
• Avoiding fines and damage to their reputation.

Companies should see the NIS2 Directive as a chance to improve their overall cybersecurity strategy.

Implementation of NIS2 into National Law

EU Member States must turn the NIS2 Directive into national law within 21 months.

In Germany, the Federal Ministry of the Interior and Home Affairs (BMI) is in charge of this.

This process includes updating current laws, like the IT Security Act (ITSiG), and creating new rules.

Authorities such as the Federal Office for Information Security (BSI) and the Federal Network Agency will be involved.

In Germany, it is likely that NIS2 will lead to stricter IT security rules, especially for operators of critical infrastructure (KRITIS) and companies in the newly covered sectors.

Best Practices to Meet NIS2 Requirements

To meet NIS2 Directive requirements and improve cybersecurity, companies should follow these best practices:

• Use cybersecurity frameworks and standards, like ISO 27001 or BSI IT-Grundschutz.
• Regularly conduct risk assessments and penetration tests to identify weaknesses.
• Train employees about cybersecurity through campaigns or phishing simulations.
• Work with external cybersecurity experts to add to internal skills.
• Create an incident response plan and practice it regularly.
• Use security measures like encryption, multifactor authentication, and network segmentation.
• Monitor security events with Security Information and Event Management (SIEM) systems and User and Entity Behavior Analytics (UEBA).
• Regularly review and update security policies and processes.

By following these practices, companies can meet NIS2 requirements and strengthen their overall defenses against cyberattacks.

Outlook and Conclusion

The NIS2 Directive is a significant step towards making Europe more secure from cyberattacks.

It helps protect companies, individuals, and critical infrastructure.

Even though it requires effort from everyone involved, it will lead to better cybersecurity and more trust in the digital world.

Companies affected by NIS2 should start preparing now.

This means reviewing their current IT systems, identifying weaknesses, and making a plan to improve cybersecurity.

Companies can also get help from external experts.

Specialized companies, like ByteSnipers, can help businesses follow the NIS2 Directive and strengthen their systems.

ByteSnipers offers a wide range of cybersecurity services, including:

• Conducting penetration tests and vulnerability assessments to find security gaps.
• Helping set up risk management and incident response plans.
• Training employees with custom cybersecurity lessons.
• Advising on the best technical and organizational security measures.
• Monitoring IT systems for threats and unusual activity.

By working with experienced partners like ByteSnipers, companies can ensure they meet NIS2 requirements and improve their cybersecurity.

Overall, the NIS2 Directive brings challenges, but it also offers an opportunity to greatly improve cybersecurity across Europe.

By following the Directive and working together, we can build greater trust in the digital world and create a safer, more successful digital future.