NIS2

The protection of our networks and systems is critically important, now more than ever. Attackers are increasingly sophisticated, and attacking with increasing frequency. NIS2 is a lot tougher than its predecessor. It’s more costly. More complex. But it’s also a smarter way to protect information assets, keeps what matters running, while raising cybersecurity standards across the board. Here’s why: the thing has teeth. Big ones.Unlike NIS1, NIS2 is armed with far heftier fines (and more compliance standards) than its predecessor. Entities within its scope must expect ad-hoc audits, expensive implementation costs and, if they don’t buckle up and comply, eye-watering fines of up to $10 million.

1. NIS2 Directive was published in the Official Journal of the European Union as Directive (EU) 2022/2555.

2. The timeframe for the transposition of NIS2 into the national laws of the 27 member states of the EU is the year 2024 (17 October).

3. This is the deadline for transposition into national law for member states, not the compliance date for entities subject to NIS2. As yet, the compliance date entities is unspecified. Follow our NIS2 Timeline blog post for updates.

4. The directive has only this to say on ‘registration’ etc:
‘Member States shall require entities referred to in paragraph 1 to submit the following information to the competent authorities by 17 January 2025:

(a)the name of the entity; (b)the relevant sector, subsector and type of entity referred to in Annex I or II, where applicable; (c)the address of the entity’s main establishment and its other legal establishments in the Union or, if not established in the Union, of its representative designated pursuant to Article 26(3); (d)up-to-date contact details, including email addresses and telephone numbers of the entity and, where applicable, its representative designated pursuant to Article 26(3);(e)the Member States where the entity provides services; and (f)the entity’s IP ranges.

APT threats are primarily associated with nation-state and sophisticated cyber-criminal organisations as they require a significant investment of resources and are fuelled by zero-day vulnerabilities. A zero-day vulnerability is a software vulnerability that is unknown (or unaddressed by the vendor) and therefore can be exploited without detection. Zero-day vulnerabilities are attained through research or purchase from the dark web and therefore require significant resources to obtain.

Entities operating within the EU that fall under ‘Essential’ or ‘Important’ sectors are covered by NIS-2, with the exclusion of ‘small’ and ‘micro’ businesses. Essential sectors span a wide range, from energy and transport to banking, health, digital infrastructure, public administration and space. Meanwhile, important entities include postal and courier services, waste management, food production, manufacturing, digital providers and research organisations, among others.

Your incident response plan should include reporting notification procedures. Operators of essential services must notify, without undue delay, the competent authority or the CSIRT of incidents having a significant impact on the continuity of the essential services they provide. Notifications shall include information enabling the competent authority or the CSIRT to determine any cross-border impact of the incident. Notification shall not make the notifying party subject to increased liability. This initial report or “early warning” to the competent national authority or computer security incident response team (CSIRT) without delay and within 24 hours from when the entity became aware of a significant incident (updated from the “without undue delay” under NIS 1). This must be followed with a more robust incident notification without undue delay and within 72 hours. Entities must then submit a final report [no more than one month later]. Entities will also be required to notify affected users without undue delay, wherever appropriate.