What is NIS2?

How many companies do you expect to be affected by NIS2?

The estimated number of companies covered by NIS2 in Germany is 29,000; in Europe as a whole it’s 400,000. But the directive is going to affect a whole lot more companies at the end of the day. This is because is the directly affected companies will also have to scrutinise the cybersecurity of their supply chains. Carmakers will in the future be able to oblige their small and medium-sized suppliers to implement commensurate cybersecurity measures so that they themselves don’t fall foul of EU regulations. What other requirements does NIS2 impose?

What other requirements does NIS2 impose?

Companies will have to train their workforce in all matters of cybersecurity, running programmes, for instance, to raise their alertness levels when it comes to the danger of phishing emails. Not only that, but company directors are also to be held personally liable in the event of breaches of the requirements. So, these directors are now going to be responsible for the implementation of security measures and will no longer be able to delegate them to third parties. The basic point is that cybersecurity management is going to become mandatory for the companies concerned. They will have to start by performing a risk analysis for the equipment and software they use, clarify who has access to the internal systems and what the associated risks are, and implement suitable security measures into the bargain. It will then be a question of creating structures for a possible cyberattack: Who will take responsibility for ensuring that certain IT systems are taken off line; who will inform the authorities, business partners, and customers ? This matters because NIS2 will also usher in strict reporting obligations. The supervisory authorities will have to be informed of any incident within 24 hours and told about the countermeasures adopted within 72. In the event of breaches of these or other requirements, companies will be faced with severe penalties of up to ten million euros or up to two percent of their global annual turnover. In other words, it’s a matter of life or death for companies to implement these requirements in full to ensure that they will avoid hefty fines and minimise the consequences of cyberattacks; this will then guarantee that their production and business operations will be able to continue largely unimpaired after an attack of this kind.

How can and should companies prepare for NIS2?

The transposition of NIS2 into national law in October is going to be cushioned by the introduction of transition periods, which may vary from member state to member state. But the affected businesses shouldn’t just sit back and wait for the end of these periods. This is because the reporting deadlines for cyber incidents will come into affect just twelve months after implementation, and some member states, the Czech Republic for instance, also want to make further obligations mandatory after this period. Firms which operate branches in these countries or have a supplier relationship with local companies will then also fall within the remit of NIS2. The basic point is that companies aren’t going to be told by the supervisory authorities but will have to decide for themselves whether they are subject to NIS2. Once the deadline in question has passed, they will have to register with the competent national authority, report incidents and observe the necessary requirements. And many companies still have gaps in their cybersecurity. Which is why businesses affected by NIS2 should get going now with implementation of the required measures, calling on the services of third parties for support if necessary.