Veeam Software recently commissioned a survey from Censuswide which looks at the status of NIS2 compliance and attitudes to this new cyber security regulation.
Organizations are ‘navigating a landscape of mixed emotions’ as the Network and Information Security Directive 2022/2555 (NIS2) enforcement date approaches. NIS2, a regulation aimed at strengthening cyber security across the EU by expanding the scope and increasing the rigor of security requirements, comes into effect on 18th October 2024.
The Censuswide survey shows widespread scepticism about NIS2, with only 43% of EMEA IT decision-makers believing that it will significantly enhance EU cyber security. This is despite an overwhelming 90% of respondents reporting at least one security incident that the NIS2 directive could have prevented in the past 12 months.
The survey results, which encompass the views of 500+ IT decision-makers from Belgium, France, Germany, the Netherlands, and the UK, reveals that although nearly 80% of businesses are confident in their ability to eventually comply with NIS2 guidelines, up to two-thirds state they will miss the imminent deadline.
Barriers to NIS2 compliance
Achieving NIS2 compliance requires businesses to implement essential measures, such as defining incident response plans, securing supply chains, assessing vulnerabilities, and evaluating overall security levels. This includes all affiliated organizations, partners, and supply chains. However, several barriers to compliance persist. Key challenges cited by IT decision-makers include technical debt (24%), lack of leadership understanding (23%), and insufficient budget/investments (21%). Notably, 40% of respondents reported decreased IT budgets since the political agreement for NIS2 was proclaimed effective in January 2023, despite its stringent penalties, which are comparable to those of the EU’s flagship data privacy legislation, the General Data Protection Regulation (GDPR). 63% of respondents view the GDPR as strict, and 62% express the same sentiment about NIS2.
The slow pace of NIS2 adoption is likely to be due to the multitude of competing priorities and business pressures that face these organizations. Respondents rank NIS2 lower in urgency than ten other issues, including the skills gap, profitability, and digital transformation. Worryingly, 42% of respondents who consider NIS2 insignificant for EU cyber security improvements attribute this to inadequate consequences of non-compliance, which has led to widespread apathy towards the directive.
Additional key findings from the survey include:
- 74% of respondents see NIS2 as beneficial, but 57% doubt it will have any substantial impact on overall EU cyber security posture.
- Sceptics cite additional concerns such as NIS2’s lack of comprehensiveness (35%), belief that compliance doesn’t guarantee security (34%), and overlap with existing regulations (25%).
- Other barriers include a lack of focus on NIS2 compliance (20%), tight timelines (19%), cyber security skills shortage (19%), directive complexity (19%), and organizational silos (19%).
- Despite conflicting views, most respondents perceive NIS2 positively in the context of their organization’s regulatory obligations, feeling optimistic (33%), confident (32%), and encouraged (27%).
NIS2 brings responsibility for cyber security beyond IT teams into the boardroom. While many businesses recognize the importance of this directive, the struggle to comply found in the survey highlights significant systemic issues. The combined pressures of other business priorities and IT challenges can explain the delays, but this does not lessen the urgency. Given the rising frequency and severity of cyber threats, the potential benefits of NIS2 in preventing critical incidents and bolstering data resilience can’t be overstated. Leadership teams must act swiftly to bridge these gaps and ensure compliance, not just for regulatory sake but to genuinely enhance organizational robustness and safeguard critical data.
Andre Troskie, EMEA Field CISO at Veeam
