Have you heard of the NIS2 Directive?
While it may not directly impact UK-only companies, it holds immediate relevance for UK businesses with subsidiaries within the EU. The NIS2 Directive raises the bar for IT security in critical infrastructure and encompasses a broader range of organisations than its predecessor.
As changes loom on the horizon, it's crucial for affected businesses to understand what lies ahead and to prepare accordingly.
Join us as we explore what you need to know about NIS2 and how you can proactively prepare for both its direct and indirect implications.
NIS2 Directive?
The NIS2 Directive (Network and Information Systems 2) is a legal act that sets a goal to be reached by EU countries and defines minimum requirements for the cybersecurity of critical infrastructure. With its implementation, the European Commission is aiming to improve the level of cybersecurity in the European Union and strengthen international cooperation in combatting cyberattacks. NIS2 has been in force since 16 January 2023, and Member States must incorporate it into their national legislation by 17 October 2024. This is going to help around 160,000 entities tighten their grip on security and make Europe a safe place to live and work. It will also enable information sharing with the private sector and partners around the world.
Am I affected by NIS2?
Many UK businesses find themselves navigating the implications of NIS2, especially those with connections or subsidiaries within the EU.
While NIS2 technically doesn't apply to UK-based companies, its impact reverberates across organisations operating within a broader European landscape. Here is what you need to know:
You were already critical infrastructure
Then you are automatically affected by NIS2.
You are in one of the 18 sectors
And you also have at least 50 employees and an annual turnover of at least 10 million euro.
Essential sectors vs important sectors
The NIS2 Directive differentiates between essential sectors and important sectors as well as between medium-sized and large sectors. This categorization affects the level of sanctions and supervision by authorities.
Company size
The following thresholds apply within the sectors:
- Medium-sized companies = 50 to 249 employees, turnover under 50 million euro and/or a balance sheet under 43 million euro.
- Large companies = at least 250 employees, turnover of at least 50 million euro and/or a balance sheet of at least 43 million euro.
Special cases
Several special cases included in the category of essential sectors are affected by the NIS2 Directive irrespective of their size, such as qualified trust service providers, TLD registries and DNS service providers.
Essential sectors – and important sectors
The NIS2 Directive identifies these 18 sectors
Essential sectors
- Energy (electricity, oil, water, hydrogen)
- Health (hospitals, laboratories, research and development, pharmaceuticals, medical device manufacturers)
- Transport (air, rail, water, road)
- Banking and finance
- Drinking water
- Waste water
- Digital infrastructure (IXPs, cloud providers, data centers, CDNs, TSPs, electronic communication providers)
- ICT service management in B2B
- Space
- Public administration (central government, regional governments)
Important sectors
- Postal and courier services
- Waste management
- Chemical products
- Food
- Processing / manufacturing industries
- Digital services (online marketplaces, search engines, social networks)
- Research
Requirements of the NIS2 Directive for CEOs/senior management
NIS2 places emphasis on cyber risk management forming part of corporate risk management – and for good reason, as cyberattacks are the greatest risk faced by businesses today. Ensuring business continuity is particularly important in the area of critical infrastructure. This is why NIS2 places responsibility on CEOs: they must support measures for cyber risk management and monitor implementation. CEOs that do not fulfil their cyber risk management obligations are personally liable for the associated risks and/or damages.
For CEOs that have not had much to do with cybersecurity so far, cyber risk management is new ground. In practice, NIS2 means CEOs must be able to identify and assess cyber risks and decide which are acceptable for the organisation and which are not. This involves considering the probability and the expected scope of damage of cyberattacks for their organisation. An essential precondition for this is conducting regular meetings with the individual or individuals responsible for IT security. Nevertheless, according to a study by Trend Micro, 51 percent of the IT teams included in the survey already speak to management about cyber risks once a week.
Requirements of the NIS2 Directive for CISOs/IT security managers
IT security managers are the ones that are faced with the challenge of implementing the NIS2 Directive. Article 21 of the directive lists the minimum requirements for cybersecurity. Apart from cyber risk management, the list also includes backup management, incident management, policies and procedures regarding the use of cryptography as well as access control and identity management, for example. The good news: If you have established standard security best practices, you can already tick off many of the requirements.
For cyber risk management, CISOs/IT security managers must be able to clearly communicate to management at any time what the current risk status looks like, which risks are most urgent and what measures the organisation should take. Cyber risk management must be conducted continuously, as the attack surface and threat environment are constantly changing.
Trend Micro supports the implementation of NIS2 by providing the most advanced security technology.
Requirements of the NIS2 Directive for compliance managers
To ensure that your organisation complies with NIS2, you must be thoroughly familiar with the regulatory requirements, document the measures taken and review their effectiveness. You should also provide training to raise awareness among employees of NIS2 compliance. Should you be affected by a cyberattack, you need to have a procedure in place for reporting the incident in a timely manner to the BSI within 24 hours.
The final requirements in each member state will only become clear once the member states’ acts for implementing NIS2 are passed. Until then, the recommendation is to become familiar with the current state of legislation in your member country (and the European NIS2 directive).
What penalties can be imposed in case of non-compliance with the NIS2 Directive?
Those who fail to fulfil their obligations under NIS2 must expect severe sanctions. The implementation of the directive provides for different fines that apply to important sectors or critical infrastructure providers and essential sectors. In case of common offences, the same heavy penalties apply to all groups.
- Essential sectors: (Temporarily) suspend certifi cation or authorisation concerning part or all of the relevant services provided or activities carried out by the entity and prevent any natural person responsible for discharging managerial responsibilities at the entity’s chief executive or legal representative level from exercising managerial functions
- Critical infrastructure providers and essential sectors: up to 10 million euro or 2% of annual turnover
- Important sectors: up to 7 million euro or 1.4% of annual turnover
Free webinar series on NIS2
#Get ready for NIS2
Trend Micro has put together a series of 6 webinars to help enterprises get ready for NIS2. Register for the live webinars or catch up on-demand and find out how Trend Micro is supporting enterprises in meeting the new guidelines.
Possible solutions for NIS2
Trend Micro solutions that support the implementation of NIS2
JOIN 500K+ GLOBAL CUSTOMERS
Get started with Trend today