NIS-2 Directive
Data security
April 10, 2024NIS 2 Directive: What you need to know about the EU IT Security Directive.
IT security is now more crucial than ever, as digital technologies play a central role in our society and economy. In this respect, the NIS 2 Directive plays an important role. But what exactly is the NIS 2 Directive and what does it mean for your company?
1 What is the NIS-2 Directive?
The NIS 2 Directive is an important measure to strengthen cyber security in the EU.
NIS stands for "Network and Information Security". The directive is therefore dedicated to protecting networks and information systems from cyber threats.
In view of the increasing risk situation in the digital space, the European Union has further developed the NIS Directive of 2016 in order to strengthen the security of systems.
This means that companies that fall under the NIS 2 Directive are obliged to implement a range of IT security measures to protect their digital infrastructures. Affected companies have until October 2024 to meet the specified requirements for their risk management, incident management, the business continuity and the reporting fulfill.
2 NIS-2: Which companies are affected?
The NIS 2 Directive extends the scope of the original NIS Directive to public and private institutions in a total of 18 sectors. This no longer only affects operators of critical infrastructures, but also providers of digital services. This means that a wide range of companies in various sectors are affected by this directive.
Whether a company from the sectors listed below is actually covered by the directive depends primarily on the size of the company: Companies with more than 50 employees and an annual turnover of at least EUR 10 million are affected.
Overview of the 18 sectors concerned:
Sectors with high criticality (Annex I of NIS-2)
- Energy
- Traffic
- Banking
- Financial market infrastructure
- Healthcare
- Drinking water
- Waste water
- Digital infrastructure
- Management of ICT services
- Public administration
- Space
Other critical sectors (Annex II of NIS-2)
- Post and courier services
- Waste management
- Production, manufacture and trade in chemical substances
- Production, processing and distribution of food
- Manufacturing/production of goods
- Provider of digital services
- Research
3 What will NIS-2 change for companies?
The biggest change brought about by the NIS 2 Directive concerns the expansion of sectors. Quite simply, more companies are affected by the regulation. In addition, companies will have to be prepared for stricter controls and - in the event of non-compliance - significantly tougher sanctions.
4 What are the requirements of the NIS-2 Directive?
If your company is affected by the NIS 2 directive, there are some important requirements that you must fulfill. These include, among others:
Risk assessment:
Organizations need to conduct risk assessments to identify potential threats to their networks and information systems.
Security measures:
Appropriate security measures must be taken to protect the systems from cyber threats. This can include, for example, the implementation of firewalls, encryption technologies and access controls.
Incident response plan:
Companies must develop incident response plans in order to react appropriately to security incidents and report them.
Mandatory reporting:
Security incidents and cyber attacks must be reported to national authorities. This also includes notifying the Computer Security Incident Response Team (CSIRT).
Collaboration and coordination:
Companies need to work with national authorities and other relevant bodies to respond to cyber security incidents.
Regular review and improvement:
Cybersecurity measures need to be regularly reviewed and updated to respond to changing threats and technologies.
Incidentally, many of these requirements already apply to critical infrastructures in Germany as part of the IT Security Act 2.0.
5 What happens if you do not comply with the NIS 2 regulations?
Failure to comply with the NIS 2 Directive can have legal consequences, including heavy fines and sanctions. In addition, the reputation of your company can be significantly impaired and the security of your customers jeopardized.
6. 5 steps you should take now to implement the NIS 2 directive in your company.
- Identification: Determine whether your company is affected by the NIS 2 Directive. This depends on your industry and the digital services you offer.
- Risk analysis: Conduct a comprehensive risk analysis to identify vulnerabilities in your networks and systems.
- Implement security measures: Take appropriate security measures to protect your systems.
- Develop an incident response plan: Create a plan for dealing with security incidents and train your employees accordingly.
- Continuous monitoring and improvement: Make sure you conduct regular security reviews and adapt your security measures to current threats.
By following these steps, you can not only ensure compliance with the policy, but also improve the security of your company and your customers. Always remember: IT security often seems like a chore, but above all it is an investment in the future of your company.
Data protection
In this article, we provide you with a comprehensive overview of data protection - from legal principles to specific measures that companies can take to ensure the security of personal data.
SIEM
A secure IT infrastructure is essential in the face of increasing cyber threats. SIEM provides early detection, rapid response, a comprehensive overview and helpful tools for compliance.
Data security
After all, the importance of data security goes far beyond the technical aspect. In this article, we explain what exactly data security is, why data security is important and which legal regulations apply to companies in Germany.
