The Directive on Security of Network and Information Systems (NIS Directive) is a European Union (EU) directive aimed at improving the overall level of cybersecurity within the EU. The NIS Directive outlines requirements for operators of essential services, such as implementing specific security measures and reporting significant cybersecurity incidents to relevant authorities. The NIS Directive was updated with the NIS2 Directive proposal, which strengthens and expands the scope of cybersecurity requirements. In this blog post, we’ll answer some frequently asked questions about the NIS2 Directive.
The NIS2 Directive applies to any medium or large enterprises operating in the sectors listed below. Essential entities will be more tightly controlled and heavily sanctioned than important entities.
Essential entities are large companies operating in sectors on the high criticality list. A large entity is a company with at least 250 employees or an annual turnover of at least €50m, or an annual balance sheet total of at least €43m. Important entities are medium-sized, operating in sectors of high criticality, or medium or large enterprises operating in sectors not considered essential due to the entity’s size or type. A medium-sized enterprise is defined as one with 50 employees or an annual turnover or balance sheet total of at least €10m.
There are a few exceptions to these classifications. In some sectors, entities, regardless of their size, are designated as essential. Some of these include providers of public electronic communication networks, entities designated as critical at the national level under the Block Exemption Regulation, government services (at the central level), qualified trust service providers, and top-level domain name registries and DNS service providers. National authorities may also specifically designate entities as “essential” or “important” if they are the sole service provider or when a disruption in service could have significant consequences for public safety, public security, or public health.
Below are the essential services included in the high criticality list:
Providers of essential services falling within the scope of the NIS regulations are subject to audits by the competent authorities. The CAF was developed by the NCSC as a framework allowing competent authorities to determine if a provider has applied appropriate measures to protect the security of their network and information systems. The CAF can also be used for self-assessment purposes.
Here is a quick timeline of the NIS2 Directive’s history and what is coming next:
Relevant entities can consider one or more of the following frameworks to help achieve compliance:
Violations of risk management measures or incident reports can incur sanctions. We break down these penalties below.
Essential entities, specifically the company to which an essential entity belongs, will be charged administrative fines of up to €10,000,000 or at least 2% of the total annual worldwide turnover in the previous fiscal year, whichever amount is higher.
Important entities, specifically the company to which an important entity belongs, will be charged administrative fines of up to €7,000,000 or at least 1.4% of the total annual worldwide turnover in the previous fiscal year, whichever amount is higher.
For the public sector, the transposing legislation may provide that the administrative fines do not apply to public administration entities. However, the other administrative sanctions will apply.
There are different key and supplementary controls in relation to governance and process, organization and people, and technology and security capabilities.
Regarding governance and process, key controls include risk analysis and information system security policies, assessing the effectiveness of cyber risk management, and business continuity. Supplementary controls include policies and procedures, risk management, disaster recovery and business continuity, security requirements, and reference network architecture.
Regarding organization and people, key controls include ensuring the management board approves and oversees the cyber risk management approach, computer hygiene practices and cybersecurity training, and supply chain security. Supplementary controls include clearly defining roles and responsibilities, security training, and third party assessment.
Regarding technology and security capabilities, key controls include incident handling, cryptography and encryption, vulnerability handling and disclosure, access control policies and asset management, and use of multi-factor authentication and secure communication systems. Supplementary controls include asset inventory, network segmentation, patch and vulnerability management, and remote access security.
Bugcrowd can help you achieve compliance with these regulations in several ways. Our Vulnerability Disclosure Programs (VDPs) support supplier and third-party monitoring and information sharing. Managed bug bounty programs are also key in vulnerability handling and disclosure. Pen testing as a service is another crucial general security measure that supports NIS2 Directive compliance.
Keep in mind that specific security controls and requirements may vary depending on the sector, size, and complexity of your organization. Organizations subject to the NIS Directive should closely monitor updates and guidance provided by relevant authorities to ensure compliance with legal obligations and best practices in cybersecurity.