NIS 2 Directive: What Does It Mean for Your Business?
What Is the Network and Information Systems Directive (NIS)?
The Network and Information Systems Directive (NIS Directive) is a piece of legislation adopted by the European Union (EU) in 2016 to increase cybersecurity and protect essential services and infrastructure from cyber threats. The NIS 2 Directive requires EU member states to establish a national framework for network and information security and designate certain operators of essential services (OES) and digital service providers (DSPs) as “critical infrastructure” that must meet cybersecurity standards. The directive also mandates incident reporting requirements and requires member states to cooperate on cybersecurity issues.
Update to NIS 2 Directive
In November 2022, the European Union announced its intention to broaden the scope of the Network and Information Systems (NIS) Directive as a solution against cyber vulnerabilities and threats. These reforms, referred to now as NIS 2, aim to establish a stronger cyber resilience by adding outsourced IT providers and managed service providers (MSPs) to the current coverage of the directive. As expected, the new rules will affect essential service providers, such as energy, healthcare, transport, or water, which will force them to adhere to the regulations and risk facing fines of up to £17 million in the UK and €10 million or 2% of worldwide turnover in the EU for any noncompliance.
The formal approval of NIS 2 took place on November 10, 2022, with the formal publication coming into force on January 16, 2023. This means that EU member states must begin implementation within 21 months of the publication date. Thus, the implementation must be completed by October 17, 2024.
What Has Changed in NIS 2 Directive?
The NIS 2 Directive rescinds the original NIS Directive and creates a more extensive and standardized set of rules on cybersecurity for organizations carrying out their activities within the EU. NIS 2 encompasses some major changes, including:
Wider Scope of Coverage for NIS 2 Directive
The number of organizations subject to the NIS 2 Directive has increased significantly over the original NIS Directive. The new NIS 2 Directive specifically defines the organizations to which the obligations apply. Inclusion of postal services, waste management, chemical production, and distribution and agricultural food sectors will see the number of sectors covered by the NIS 2 Directive increase from 19 to 35.
Additionally, NIS 2 provides greater detail on which entities within these sectors are subject to requirements. Any entity with more than 250 employees and an annual turnover of more than €50 million and/or an annual balance sheet above €43 million is covered. And in certain circumstances, entities must comply irrespective of company size, such as public electronic communications network providers.
Strengthened Security Requirements
The NIS 2 Directive strengthens security requirements for businesses by enforcing a risk management approach and providing a minimum list of basic security elements that must be applied. In addition, it introduces more specific provisions on the process of reporting incidents, the content of the reports, and the timing (i.e., within 24 hours of the discovery of the incident).
NIS 2 aims to enhance collaboration by increasing trust and facilitating the sharing of information between EU member states and their coordinated management of large-scale cyber crises at the EU level. This led to the creation of the European Cyber Crisis Liaison Organization Network (EU CyCLONe), which is specifically dedicated to these initiatives at the EU level.
Faster Incident Reporting
NIS 2 mandates that key and critical entities must notify their respective national computer security incident response teams (CSIRTs) or, if applicable, the relevant competent authorities of any incident that has a major effect on their services. The steps to be taken include: sending an early warning within 24 hours of becoming aware of the incident, which must mention whether the incident could be the result of malicious acts or have a cross-border effect; sending an incident notification within 72 hours, providing an initial review of the incident and its magnitude and outcomes; sending an intermediate report if requested by the CSIRT, or competent authority; and sending a final report no later than one month from the notification of the incident, which must detail the likely cause of the incident, any mitigation measures employed, and any cross-border repercussions of the incident.
EU member states will be able to use a stringent enforcement system, which includes the right to conduct inspections, safety evaluations, and demand data and documents. Breaches of the NIS 2 Directive could result in severe financial penalties:
- Up to €10 million or 2% of the total worldwide annual turnover for OES (Operator of Essential Services)
- Up to €10 million or 2% of the total worldwide annual turnover for DSPs (Digital Service Providers)
Management of Third-party Risks in the Supply Chain
The supply chain is a focus of cyberattacks. Supply chain risk management (SCRM) seeks to understand and balance the differences between existing security controls, potential vulnerabilities, regulation requirements, and business goals. NIS 2 takes this cybersecurity risk into account by requiring stringent risk management of the supply chain.
Strengthened Security Requirements
A risk-based approach to security underpins the new security obligations of the NIS 2 Directive. This approach is in line with other regulations such as the General Data Protection Regulation (GDPR). Incident response and crisis and risk management techniques play a key role in compliance with NIS 2 and should be a basis for implementing the security measures outlined in the directive. To maintain a high level of security within essential service providers, NIS 2 requires that relevant organizations must comply with strict requirements for:
- Completing a risk assessment and having sufficient information system security policies in place
- Preventing, detecting, and responding to incidents promptly
- Crisis management and operational continuity in the case of a major cyber incident
- Ensuring the security of their supply chain
- Ensuring the security of their network and information systems
- Having policies and procedures in place that assess the effectiveness of cybersecurity risk management practices
- Using strong encryption
How Businesses Can Improve Their NIS 2 Readiness
Businesses can improve their NIS 2 compliance readiness by implementing the following measures, such as:
Adopting a Content-defined Zero-trust Model
Zero-trust models are based on the principle of “never trust, always verify,” limiting access to a company’s network or system to only authorised users. Authentication policies must be implemented to ensure that access is not granted unless the user has been identified by the system via multi-factor authentication (MFA) or some other verification process. A content-defined zero-trust approach should include granular access control policies and logging to enable businesses to protect their sensitive content communications from cyber and compliance risks.
Cybersecurity Risk Management
Risk management must be a central component to any organisation’s security strategy. Risk assessments should be conducted on a regular basis to identify any potential threats or vulnerabilities. Policies and controls should also be put into place to counter any identified threats. This includes both technical solutions, such as firewalls, intrusion detection systems, and antivirus/anti-malware protection, as well as nontechnical solutions such as employee security training and procedures to manage and monitor potential risks.
Multi-factor authentication can be used to add an additional layer of security to user authentication. This requires users to enter two or more authentication factors, such as a username and password, in order to gain access to a system or resource. This is especially important for remote access, where an additional verification process, such as a one-time code sent via SMS or email, adds an extra layer of security.
End-to-end encryption is critical for protecting sensitive data that is stored or transmitted over a network. This is a process of scrambling data, making it unreadable until it is unlocked using a proper key. There are several encryption algorithms that can be used, such as AES-256 encryption. Encryption can also be used to anonymize data or to ensure that only authorized users can access it, such as via an encryption key.
Secure File Sharing
This involves implementing a secure file sharing solution to protect confidential data from being shared with unauthorized individuals. This can include the use of access control policies to only allow authorized personnel to access the data and tools to monitor which staff members are sharing files. Additionally, digital rights management (DRM) can be used to control who can open, edit, and share files, and access can be restricted based on roles and user profiles.
Email is often the first target for social engineering or phishing scams, so it is important to ensure that emails are secure and that any sensitive information is encrypted. Secure email solutions can help protect against unauthorized access or interception of messages, and can include encryption, digital signatures, and other security measures.
Security Training and Awareness Program
It is essential that staff are aware of proper cybersecurity practices and can recognize and avoid potential threats. This can be accomplished through security training and awareness programs, which can include topics such as phishing scams, social engineering tactics, and creating strong passwords. Additionally, it is important that employees remain up to date on new security measures, best practices, and the latest threats.
Network Security Solutions
Firewalls, intrusion prevention systems, and antivirus/anti-malware solutions are all essential elements of a comprehensive network security solution. Firewalls can be used to control the flow of traffic entering and leaving the system, preventing unauthorized access. Intrusion detection systems can detect any malicious activity, such as malware, data loss, and hacking attempts, and alert administrators. Antivirus/anti-malware solutions can protect against any malicious software that might be present on the system. Additionally, an effective security strategy should also include regular system and network scans, application patching, monitoring, and testing.
How Kiteworks Can Support Businesses Through NIS 2 Compliance
The Kiteworks Private Content Network provides a level of visibility and control to help businesses under the NIS 2 Directive to demonstrate compliance. The Kiteworks platform does this through:
Enforcing Compliance With Information System Security Policies
Kiteworks allows customers to standardize security policies across email, file sharing, mobile, MFT, SFTP, and more with the ability to apply granular policy controls to protect data privacy. Administrators can define role-based permissions for external users, thereby enforcing NIS 2 compliance consistently across communication channels.
Supporting Business Continuity
Maintain accurate records of all activities and technical data with user-friendly tracking displays, allowing audit logs to serve the dual purpose of ensuring that an organization can investigate data breaches and provide evidence of compliance during audits. In the event of a breach, this grants an organization the ability to see exactly what was exfiltrated so they can get to work immediately on disaster recovery and continue their day-to-day business while maintaining compliance.
Defining and Enforcing Basic Cyber Hygiene Practices
ISO has validated Kiteworks to effectively protect your sensitive content from cyber risk (ISO 27001), including when deployed as a cloud service (ISO 27017), and to shield your organization from damaging leaks of personally identifiable information (PII) as validated by ISO 27018. In addition, Kiteworks has a library of compliance certifications, including being SOC 2 compliant and SOC 2 certified. These certifications, along with the single-tenant architecture and multilayered hardening, validate Kiteworks’ ability to mitigate content risk with the content management system and keep your basic cyber hygiene practices within NIS 2 compliance.
Protecting Content With Encryption
Ensure volume and file level encryption of all content at rest (with AES-256 encryption) and TLS encryption in transit to protect content from unauthorized access, data corruption, and malware. Flexible encryption allows customers to use Kiteworks’ end-to-end encryption and bridge to partners with different standards such as OpenPGP, S/MIME, and TLS. Kiteworks’ secure email provides encryption and uniform security controls with an Email Protection Gateway (EPG) that ensures only authenticated users can read messages.
Establishing Access Control Policies and Asset Management
Kiteworks administrators set up granular controls to protect sensitive content and enforce compliance policies, enabling business owners to easily manage content, folders, invitations, and access controls to ensure NIS 2 compliance of all content. Access control can be further managed within compliance with geofencing, app enablement, file type filtering, and email forwarding control.
Kiteworks provides a range of features to enforce compliance with information system security policies, handle incidents with efficiency, support business continuity, manage vulnerabilities in development and maintenance, define and enforce basic cyber hygiene practices, protect content with encryption, establish access control policies and asset management, and verify users with multi-factor authentication. These features enable organizations to detect and respond to security incidents, manage vulnerabilities, and maintain compliance with NIS 2 requirements.
Businesses across the EU looking to start their journey to NIS 2 compliance can schedule a custom demo to learn more about the Kiteworks platform.
- Video NIS 2 Directive: Requirements, Obligations, and How Kiteworks Can Help With Compliance
- Brief Optimize File Sharing Governance, Compliance, and Content Protection
- Webinar Unlock the Power of REAL Zero Trust Through Content-based Risk Policies
- Case Study Mitigating Risk With a Single, Secure File Sharing Platform
- Blog Post Zero Trust Architecture: Never Trust, Always Verify