NIS2 compliance: how to prepare for the October 2024 deadline

The world of cybersecurity is becoming increasingly regulated – and for good reason. Standards and regulations help protect organizations and their customers from excess risk when it comes to cyber incidents, in turn bolstering security for everyone. In 2018, the European Union (EU) Network and Information Systems (NIS) Directive came into force, aiming to improve the security of network and information systems for EU organizations, as well as companies and suppliers operating within the EU. In October 2024, updates to the directive, known as NIS2, are set to take effect. What does this mean for organizations and how can they stay safe and compliant without compromising innovation? The answer is straightforward: don’t neglect the basics.

NIS2: what’s changed?

The changes to the NIS Directive primarily affect the security measures and reporting obligations for medium and large-sized EU enterprises, as well as other organizations identified by governments as ‘essential’ or ‘important’ entities. The scope of the directive now encompasses an expanded list of 18 key industries including energy, transport, health, finance, and manufacturing. It is estimated that at least 100,000 companies will need to comply with NIS2, a significant increase from the current NIS Directive.

In addition to covering more sectors, the NIS2 directive mandates that affected entities must implement effective and suitable organizational and technical measures to mitigate cybersecurity risk. The most significant change, however, is the increased focus on incident reporting to national authorities by providers of digital infrastructure services.

NIS2 also extends to supply chains and outsourcing partners, with a specific focus on risk management. Given the prevalence of high-profile supply chain attacks, such as the June 2023 MOVEit attack that affected an estimated 400 organizations, the renewed emphasis on supply chain security is unsurprising.

Proactivity and compliance: bolstering security now

As with most aspects of cybersecurity, proactivity is crucial to both compliance and enhanced security. Whilst EU member states have until October 2024 to incorporate the NIS2 Directive into their national laws, organizations should begin preparations now. To avoid penalties and non-compliance, proactive measures are essential.

For organizations that are already compliant with the original NIS directive, conducting an audit is the first step to identifying areas needing updates. However, all organizations, regardless of their current compliance status, should take steps to prepare. This includes evaluating and addressing risks to existing networks and security systems, implementing appropriate risk mitigation policies, strengthening defences against ransomware attacks, and scrutinising supply chains.

Failure to comply can be both costly and dangerous. Penalties for non-compliance are designed to ensure that entities take their cybersecurity obligations seriously, with consequences varying based on the specific national legislation of each EU member state. The NIS2 Directive provides a framework for national lawmakers on potential penalties for non-compliant organizations, including monetary fines, public notices, reputational damage, and operational restrictions. Penalties also vary depending on the organization’s size and the scale of non-compliance.

So, how can organizations get ready for compliance?

Cyber hygiene: passwords, privileged access and reporting

When addressing cybersecurity measures, organizations frequently underestimate the importance of robust password security, despite passwords serving as a vulnerable entry point for cybercriminals. As threats continue to evolve, bolstered by advancements in artificial intelligence (AI) and emerging technologies, it is understandable how fundamental practices may be overlooked by both IT teams and end users. Nevertheless, the significance of implementing strong password practices cannot be understated.

Paragraph 49 of the NIS2 Directive mandates that organizations implement adequate cyber hygiene policies, while Paragraph 89 requires the establishment of cyber hygiene practices for users. To comply with these directives, organizations should employ comprehensive password management tools and educate all personnel, starting with the IT team, on password best practices. This involves using a password manager to generate and securely store complex passwords in addition to thorough password-focused training for end-users. Enforcing mandatory multi-factor authentication (MFA) can significantly bolster the effectiveness of cyber hygiene policies.

To meet compliance with the NIS2 Directive, organizations should also implement measures to safeguard privileged accounts by limiting access and regularly rotating administrator passwords. Recognising the importance of access control is crucial for minimising excess risk. Conduct thorough evaluations of who needs access to sensitive information, and why, then mitigate risk by implementing a privileged access management (PAM) solution.

Additionally, adopting zero-trust principles is an effective strategy to bolster an organization’s security posture and establish strong cyber hygiene for both end users and IT teams. Transitioning to a zero-trust approach involves implementing multiple layers of defence to validate access attempts. This means not granting indefinite access, conducting regular access reviews, and continuously monitoring user activity. A zero-trust security model, in conjunction with least-privilege access, role-based access controls (RBAC), a single sign-on (SSO) solution, and robust password security, can significantly decrease the likelihood of a successful attack and stymie a threat actor’s access.

One of the most critical updates affecting both new and existing EU organizations under NIS2 is the heightened reporting standards. Any cyber incident must be reported within 24 hours of detection. Utilising continuous scanning tools and alert capabilities, particularly for breached passwords, can be helpful in mitigating this risk.

Taking compliance seriously

With the deadline approaching, it’s crucial for organizations to demonstrate their commitment to NIS2 compliance by implementing appropriate and proportionate controls. Proactively working towards compliance now can help organizations avoid penalties and bolster security for employees, customers and end-users. Business leaders cannot overlook the fundamentals of robust password policies and a strong security culture. A focus on zero-trust principles and privileged access management is crucial for a more secure and innovative future for all.