Preparing for NIS2: Your Roadmap to Cybersecurity Compliance

Especially for organisations that have not yet been required to address information security, the biggest challenge initially will be to set up the strategy, roles and responsibilities and an overall framework for information security within the company. They must set this up, even if they must fulfil only the lower requirements level.

All organisations must have implemented functional and adequate processes for Business Continuity, Incident Management, Disaster Recovery, Backup Management, Third Party Management, Basic Cyber Hygiene and more.

There is a new obligation to educate members of the management body on cybersecurity to be able to consider and assess cybersecurity risks. The typical training methods are seldom interesting for this specific group and the specific training objective, and therefore, alternatives such as Round Table exercises should be considered. Round Table exercises utilise experienced experts to discuss selected topics (usually the actual threats and their potential impacts) with members of management.

Another option that companies appreciate is the Table-Top Exercise, where tailored scenarios of cyber incidents are addressed. Through Table-Top exercises, you can identify weaknesses in your organisation's security and incident response and management process. The Round Table and Table-Top exercises will significantly enhance cybersecurity awareness among the most important target group.

Organisations under the NIS2 Directive must implement fundamental measures to reduce risk as part of risk management and mitigation efforts. Risk analysis is the primary measure here, followed by the management of the identified risks. This involves monitoring assets, evaluating them, conducting risk assessments, and creating a plan to mitigate identified risks.

The risk analysis is crucial for properly managing the organisation's cybersecurity processes. It serves to pinpoint risks that could cause significant problems for your organisation. Incorporating risk analysis into the organisation's processes ensures that decisions about which measures to implement and at what level or which not to implement are entirely justifiable and make sense even from the standpoint of efficient financial management. By thoroughly understanding the risks, organisations can allocate their resources more effectively, avoiding unnecessary expenditures on low-impact risks and focusing on measures that yield the highest benefit in reducing vulnerability and exposure.

However, conducting a risk analysis that provides valuable outputs is not simple. It's necessary to consider the appropriate granularity of inputs to weigh up the methodology that will be feasible to carry out in a reasonable amount of time and yield meaningful results. From our experience, it happens all too often that a risk analysis carried out improperly results in hundreds of risks that do not allow for sensible strategic decisions in cybersecurity management.

Essential and critical entities must notify their competent authority without undue delay of any significant incident. Where an incident is likely to affect adversely the provisioning of their services, they must also inform the recipients of those services without undue delay.

A significant incident is an incident which has caused or is likely to cause severe disruption to the operation of the services or financial loss to the organisation or which has affected or is likely to affect other natural or legal persons by causing them significant material or non-material damage. From this vague specification, it is quite clear that almost any incident can be categorised as significant.

Notifying an incident must be made immediately but no later than 24 hours after discovery. To meet this requirement, an organisation must set up processes, responsibilities, and tools to ensure timely incident reporting.

This mechanism helps ensure that the relevant authorities have timely and sufficient information about current incidents and threats to other entities. This information should then be provided to other actors to improve readiness and response to incidents in the EU.