NIS2 is the European Union's cybersecurity directive, formally Directive (EU) 2022/2555. It replaces the original NIS directive from 2016 and reaches far more organizations. Many midsize companies that never gave it a thought are now in scope, and so are the service providers they rely on.
IN THIS ARTICLE
Organizations in scope must take appropriate technical and organizational steps to manage risk. The directive lists risk analysis, incident handling, business continuity and backups, supplier security, secure development and vulnerability handling, access control, multi-factor authentication, encryption and staff training.
An early warning is due within 24 hours of becoming aware of a significant incident. A fuller notification follows within 72 hours, and a final report within one month. The early warning has to say whether the incident may be malicious and whether it could affect other EU countries. A team without visibility into its network may spot an incident but not be able to tell how far it has spread in the time allowed. That leaves others exposed to the threat and the organization exposed to penalties.
Senior management must approve and oversee the security measures, and can face personal liability. The directive also expects leaders to take training. That puts security on the board’s agenda. Not everyone needs to become a security expert, but everyone in the room should understand the measures and who does what when an incident happens. Practice it like a fire drill.
Organizations in scope must assess the security of their suppliers and service providers, MSPs and resellers included. A small IT partner may never be regulated directly and still be asked to prove its practices to a customer who is.
Each EU member state turns the directive into national law, so check how your country applies it and whether your organization counts as essential or important. More information here.