Are you Ready for the NIS-2-Directive?

The NIS-2-Directive represents the EU-wide standard for cybersecurity and has a broader scope as compared to the original NIS-Directive. This means that more entities and sectors are now subject to risk management and incident reporting requirements than before.

Affected organisations must take appropriate technical, operational and organisational measures in order to manage the security risks of their network and information systems used for their operations or services. They must also take measures to prevent or minimize the impact of incidents on the users who use their services as well as other related services.

The NIS-2-Directive affects entities from 18 sectors listed in Annexes I and II. These sectors are classified as “highly critical sectors” and “critical sectors”. In addition, the number of employees (>50) and the annual turnover or balance sheet total play a role in determining who is affected.

The affected companies must take various measures to improve their cybersecurity in order to meet the NIS-2 requirements. In accordance with Chapter Chapter IV, Articel 21 of the NIS-2-Directive, the essential requirements include:

• Concepts pertaining to risk analysis and security for information systems
• Handling of security incidents
• Maintaining business continuity measures such as backup-management and recovery after an emergency, and crisis management
• Supply chain security including security-related aspects of the relationships between individual entities and their direct vendors and service providers
• Security measures during the acquisition, development and maintenance of network and information systems, including management and disclosure of vulnerabilities
• Concepts and procedures for evaluating the effectiveness of the risk management measures in the area of cybersecurity
• Basic procedures in cyber hygiene and training in cybersecurity
• Concepts and procedures for the use of cryptography and, if required, encryption
• Personnel security, access control concepts and management of the personnel and asset management
• Use of multi-factor authentication solutions or continuous authentication, secured voice, video and text communication and secure emergency communication within the organisation, if required