The Importance of the NIS2 Directive
NIS2 creates a standard set of cybersecurity requirements for organizations providing essential or important services to EU member states. By doing so, it reduces the risk that cyberattacks against these organizations could result in significant repercussions for EU citizens.
Sectors Affected By The NIS2 Directive
The NIS2 directive classifies sectors into essential and important entities. Examples of essential entities (EE) include:
- Energy
- Transportation
- Finance
- Public administration
- Healthcare
- Space
- Water supply
- Digital infrastructure
NIS2 also impacts important entities (IE), such as:
- Postal services
- Waste management
- Chemicals
- Research
- Food
- Manufacturing
- Digital providers
In addition to sectors, NIS2 compliance is also affected by the size of the organization. In general, EEs must have at least 250 employees and an annual turnover of over 50 million euros or a balance sheet of 43 million euros. IEs generally must have at least 50 employees and an annual turnover or balance sheet of at least 10 million euros. However, these rules vary by sector. Additionally, companies that are the sole provider of a particular service within an EU member state may be classified as an EE or IE regardless of size.
What are the NIS2 Requirements?
NIS2 creates four sets of high-level organizational requirements, including:
- Risk Management: Organizations should manage their cyber risks via incident response, supply chain security, network security, access control, and the use of encryption.
- Corporate Accountability: Corporate management is accountable for the organization’s security and should take an active, informed role in cyber risk management.
- Reporting Obligations: NIS2 defines reporting requirements for significant security incidents, including a 24-hour “early warning”.
- Business Continuity: Affected organizations should have business continuity strategies in place, including creating recovery plans, emergency procedures, and a crisis response team.
Additionally, it specifies a set of ten minimum requirements, which include:
- Performing risk assessments and implementing security policies for IT systems.
- Implementing policies and procedures for the use of cryptography and encryption.
- Securing and managing vulnerabilities in system procurement.
- Implementing security procedures for users who can access sensitive data.
- Using multi-factor authentication (MFA), continuous authentication, and encrypted communications when appropriate.
- Evaluating the effectiveness of the security controls put in place.
- Planning for incident detection and response.
- Training employees on basic computer hygiene.
- Planning for business continuity and disaster recovery (backups, continued access, etc.)
- Securing the supply chain and how the company manages potential vulnerabilities in third-party relationships.
Penalties for NIS2 Violations
NIS2 lays out various types of penalties that can be levied against an organization for non-compliance, including:
- Non-Monetary Penalties: National supervisory authorities are permitted to force organizations to become compliant, follow binding instructions, carry out a security audit, or notify their customers about a potential threat.
- Administrative Fines: Administrative penalties depend on the type of entity. EEs are subject to fines of the greater of 10 million euros or 2% of global annual revenue. IEs can be fined up to 7 million euros or 1.4% of global annual revenue.
- Criminal Sanctions: In the event of gross negligence, NIS2 allows top management to be held personally responsible for security incidents. This includes ordering the company to make compliance violations public, publicly state what violation occurred and who is at fault, and temporarily barring individuals from holding management positions.
Ensure that Your Business is in Compliance with the NIS2 with IGS
The NIS2 directive is designed to limit the risk that cyberattacks against essential and important entities within the EU will impact their ability to provide services to EU citizens. This update to the original NIS expands the scope of the directive, implements updated requirements, and provides regulators with the power to levy additional, more stringent penalties against organizations that fail to comply with its requirements.
Achieving compliance with the NIS2 directive by deadlines in Q4 2024 is essential for all affected organizations and requires the implementation of a robust cybersecurity program. Check Point offers support for companies attempting to achieve this and other cybersecurity goals through its Infinity Global Services program.
Check Point’s NIS2/DORA Readiness Assessment involves an on-site assessment by senior Check Point consultants of an organization’s existing compliance with the NIS2 directive. Based on this assessment, Check Point provides guidance on how organizations can close identified security gaps and achieve compliance with the standard. For more information on how to achieve your NIS2 compliance goals before the deadline, contact us.
Feedback