How Do The UK Cyber Security & Resilience Bill & The EU's NIS2 Compare?

The  British government's Cyber Security and Resilience Bill proposed in the King’s Speech is widely regarded as a much needed update to the Network and Information Systems (NIS) regulations and seen as the UK equivalent to the European Union (EU) NIS2.

It follows a review of the NIS regulations conducted two years ago and is described as an “urgent update” following the discovery that only just over half of operators of essential services have updated or strengthened existing policies and processes since the inception of NIS in 2018. However, the Bill differs from NIS2 in a number of ways.

Admittedly, the two do have similar aims. The Bill intends to strengthen the UK’s cyber defences by expanding the remit to include more digital services and their respective supply chains and by mandating increased incident reporting. This will ensure the government can keep abreast of trends by mandating disclosure of things like ransomware attacks. 

NIS2 will also apply to far more organisations, adding ‘important’ to ‘essential’ entities which is expected to see over 160,000 brought in scope, across over 17 verticals compared to the seven under NIS. Its aim is to improve the resilience of the EU through more timely incident reporting (an early warning must be made within 24 hours of a significant incident) which will facilitate the sharing of threat intelligence between member states. In this respect, NIS2 has been far more specific over who will be affected.

What’s Required?

We don’t yet know what demands the Bill will make in terms of processes and controls, but NIS2 states that both management bodies and employees will have to undergo security training on a regular basis to “identify risks and assess cybersecurity risk-management practices and their impact on the services”.

They’ll also have to implement technical, operational and organisational measures to manage those risks and to prevent and minimise the impact from their realisation.

Article 21 proceeds to name measures which include, for instance, risk management policies, business continuity/disaster recovery, system acquisition and maintenance, cyber hygiene, cryptography and encryption, and MFA.

When it comes to accountability and enforcement, NIS2 is also very clear on the potential repercussions of non-compliance. Senior management personnel can be held personally accountable and suspended from duty and regulators have a series of actions they can take to ensure compliance.

These range from warnings and ‘cease and desist’ orders, to requirements to meet certain risk management remedial obligations in a specified timeframe, to on-site inspections and targeted security audits (to be carried out by a third party and charged back to the entity), for example. There are also some hefty fines of a maximum of 10m Euros or 2% of worldwide annual turnover, whichever is higher, for essential entities and 7m Euros or 1.4% of worldwide annual turnover, whichever is higher, for important ones. 

The UK Bill has yet to unveil its punitive measures or whether board level personnel could potentially be implicated, although the latter is a general direction of travel seen globally. In the US we saw the SEC make board members accountable last July, for instance, when it revised its cyber incident disclosure processes.

The Implications For UK Businesses

Those organisations that do business in or with those based on the continent can expect to have to meet both sets of regulations and so will need to seek harmonisation where they can to reduce costs and complexity. There are already concerns that NIS2 will prove expensive, with medium-sized businesses newly within scope likely to experience the most upheaval. But the regulations also provide an opportunity to level the cyber security posture of these nations on an unprecedented scale. In doing so, they will drive down risk and the likelihood of economic disruption.

To both conserve spend and reap the maximum benefits from the process, organisations should therefore seek to look to streamline their compliance. This can be achieved by looking for overlap with other regulations and frameworks, such as ISO27001 and ISO22301, IEC62433, and the CIS critical controls. Many of these, in common with NIS2, compel the entity to implement an information security management system (ISMS), for instance, which is a management approach that governs people, process and technology. 

In keeping with the ISMS, the entity can put in place a Security Incident and Event Management (SIEM) to meet many of the demands of the regulations with respect to threat detection and response. Some SIEM also come with compliance management features that are specifically tuned to fulfil NIS2 and generate audit trails and reports to demonstrate compliance. 

How closely the UK Bill decides to mirror NIS2 remains to be seen but the impetus worldwide would seem to indicate we can expect the regulations to be more wide ranging, for the board to be accountable, and for incident reporting to be much more instantaneous.

All of these requirements will demand businesses implement far more rigorous processes regardless of which side of the channel they reside upon.

Innes Muir is Regional Manager at Logpoint

Image: Ideogram

You Might Also Read: 

Six Steps On The Road To NIS2 Compliance:


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

 

 

« What Security Teams Need To Know About The EU’s NIS 2 Directive
Making Insider Threats A Year Round Priority »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Protective Intelligence

Protective Intelligence

Protective Intelligence brings together a group of information security specialists with a passion for delivering high-quality solutions.

Covenco

Covenco

Covenco is a data management and IT infrastructure specialist. Working with customers to transform their IT environments, with data protection and security at the forefront of everything we do.

Planit Testing

Planit Testing

Planit is a leader in Quality Assurance and a specialist in software testing and training services.

Guardsquare

Guardsquare

GuardSquare is the global reference in mobile application protection. We develop premium software for the protection of mobile applications against reverse engineering and hacking.

Sonrai Security

Sonrai Security

Sonrai Security delivers an enterprise security platform focused on identity and data protection inside AWS, Azure, and Google Cloud.

CYBRScore

CYBRScore

CYBRScore is a premium, performance-based cyber skills training and assessment provider that quantifies a user’s ability to defend a network.

HunCERT

HunCERT

HunCERT's mission is to assist Hungarian Internet Service Providers in applying appropriate procedures to address the risks of computer network incidents and to respond to such incidents.

Glocomp Systems

Glocomp Systems

Glocomp Systems is one of Malaysia’s premier ICT infrastructure distributor offering a comprehensive portfolio of solutions including cybersecurity and privacy.

X Technologies

X Technologies

X Technologies provide world-class engineering, information technology, information security, program management and repair services to Federal, State and commercial customers.

ConnectSecure

ConnectSecure

ConnectSecure (formerly CyberCNS) is a global cybersecurity company that delivers tools to identify and address vulnerabilities and manage compliance requirements.

Ciphertex Data Security

Ciphertex Data Security

Ciphertex is a leading data security company that specializes in portable data encryption and privacy protection storage systems.

Green Radar

Green Radar

Green Radar is a next generation cybersecurity company which combines technologies and services together to deliver Threat Detection for Emails and Deep Threat Analytics and Response.

Acumera

Acumera

Acumera is a leader in managed network security, visibility and automation services.

Aravo Solutions

Aravo Solutions

Your Extended Enterprise is full of hidden risks – Aravo makes them visible, measurable, and manageable.

SecurEnvoy

SecurEnvoy

SecurEnvoy are a leader in designing zero access trust solutions using the latest cutting-edge technologies, to protect your users, devices and data, whatever the location.

Secolve

Secolve

Secolve is Australia’s next generation OT specialist cyber security firm, working with key industries to protect the nation’s critical infrastructure.