As cybersecurity threats continue to evolve, the European Union is tightening its regulatory framework. On October 17, 2024, the EU will begin enforcing the NIS 2 (Network and Information Security Directive 2), a major update to its cybersecurity regulations. This new directive introduces stringent requirements for companies operating within the EU, aimed at improving internal cybersecurity strategies and practices. Businesses failing to comply could face significant fines or even service suspensions, making NIS 2 a crucial development for companies in essential sectors such as banking, healthcare, energy, and transportation. This article outlines the key aspects of NIS 2, what it means for businesses, and the potential penalties for non-compliance.
Key Takeaways:
NIS 2 Enforceability: Effective from October 17, 2024, across the EU.
Scope: Applies to essential services such as finance, healthcare, energy, transportation, and internet providers.
Penalties: Fines of up to €10 million or 2% of global annual revenues for essential entities, and €7 million or 1.4% for important ones.
Response Requirements: Companies must report cyber breaches within 24 hours, stricter than the GDPR’s 72-hour notification rule.
Source: f24
The NIS 2 (Network and Information Security Directive 2) is a revision of the original NIS directive, aimed at enhancing the cybersecurity of critical IT systems and networks within the EU. Introduced in 2020, it was designed to address the rising cybersecurity challenges as hackers develop increasingly sophisticated methods to breach corporate defenses.
Expanded Scope: NIS 2 broadens the range of businesses covered, including sectors such as healthcare, banking, energy, internet providers, and waste management.
Core Focus: The directive emphasizes risk management, corporate accountability, and business continuity planning in the event of cyberattacks.
Geert van der Linden, executive vice president of global cybersecurity services at Capgemini, highlighted that NIS 2 has set a new standard for corporate cybersecurity. “NIS 2 will be seen as a global standard by judges when it becomes enforceable,” said van der Linden. He noted that compliance with the directive would offer protection from legal claims, akin to taking out insurance against burglary.
The key areas NIS 2 addresses include:
Risk Management: Companies must bolster their cyber resilience strategies, ensuring they can withstand attacks.
Corporate Accountability: Cybersecurity becomes a boardroom-level responsibility, with a focus on reporting obligations and continuity planning.
Supply Chain Security: Firms are required to vet their digital supply chains to assess potential vulnerabilities in third-party vendors.
Collaboration and Transparency: Businesses will need to share information about cyber threats and vulnerabilities with peers, fostering a more open approach to managing security risks.
Chris Gow, head of Cisco’s EU public policy team, noted that companies will need to perform a comprehensive "mapping exercise" of their technology vendors to identify potential cyber risks.
Non-compliance with NIS 2 can lead to severe financial and operational penalties, depending on the size and importance of the company:
Essential Entities: Companies in critical sectors like finance, healthcare, and transport can face fines of up to €10 million or 2% of global annual revenues — whichever is higher.
Important Entities: Firms in other essential sectors like food and waste management face fines of up to €7 million or 1.4% of their annual revenues.
Service Suspensions: In addition to financial penalties, businesses may face suspensions or closer regulatory oversight if they fail to comply with the law.
A key feature of the new law is the obligation for businesses to submit an early warning notification within 24 hours of discovering a cyber breach. This is significantly more stringent than the 72-hour window required under the GDPR.
Businesses have been scrambling to align their internal processes with the new NIS 2 requirements ahead of the October 17 deadline. While many companies have made cybersecurity a top priority, there is still a lot of preparation left to be done. Cisco’s Chris Gow emphasized that the directive has pushed companies to act faster in tightening their cybersecurity controls and policies.
Some experts, like Carl Leonard, EMEA cybersecurity strategist at Proofpoint, see NIS 2 as an opportunity for businesses to gain a competitive edge by exceeding compliance standards. Leonard also highlighted that the directive would foster collaboration across the EU, with a unified approach to cybersecurity and shared intelligence on cyber threats.
However, the threat of cyberattacks remains prevalent. Earlier this year, a ransomware attack on Synnovis, a private UK healthcare provider, disrupted over 3,000 hospital appointments, highlighting the importance of robust cyber defenses.
The EU’s NIS 2 directive represents a significant shift in the regulatory landscape for cybersecurity. As cyberattacks continue to rise, the new rules are designed to hold businesses accountable for their resilience and reporting practices. With potential fines in the millions and service suspensions on the line, compliance with NIS 2 is not just a regulatory requirement but a business imperative. Companies must take the necessary steps to align with the directive, safeguard their operations, and protect consumers from the ever-growing threat of cybercrime. The enforcement of NIS 2 sets the stage for a more secure digital environment across the European Union.
