NIS2 Regulations Are Coming – Are You Ready?

The European Union's Network and Information Security (NIS) directive is evolving, with tighter rules and tougher sanctions that will apply to more organisations than was previously the case.

Those that assume they won’t fall under its remit could find themselves on the back foot, unless they get up to speed with the likely compliance requirements now. 

Many UK businesses have had to comply with the EU Network and Information Systems (NIS) cyber security standards for years. The regulations were imposed in 2016 to better protect the security and resilience of essential everyday services – such as water, energy, healthcare, transport and digital infrastructure – from online attacks, and they remain part of British law. The regulations are tightening for those countries that are still part of the EU, with stricter rules and reporting requirements, and higher penalties for compliance failures.

When it takes effect in 2024, the updated legislation will apply to medium-sized and large UK businesses that provide their services or carry out their activities in the EU. Those that only operate in the UK can’t relax, however, as the original NIS regulations will continue to apply to UK organisations. In addition, a number of new industry sectors not covered by NIS1 are now being pulled in. 

More significantly, a UK version of the rules is coming very soon: at the start of this year the government stated that “the NIS regulations will be updated as soon as Parliamentary time allows”. The intention is to strengthen the UK’s cyber laws against digital threats, according to Cyber minister Julia Lopez, in order to protect essential services and the IT providers which keep them running.

Once the rules come into force, affected organisations will be subject to random checks, regular security audits, on-site inspections and off-site supervisions. For those found to be in breach of the regulations, penalties could be as high as 10 million Euros or 2% of their global turnover - whichever is higher.

The Ground It Will Cover

It’s highly likely that the UK’s NIS framework will be very similar to the EU’s version. This means that entities which come under its remit will be required to perform regular security assessments, adopt incident response plans, appoint a chief information security officer (CISO), and report significant incidents to the national authorities, among other obligations.

The UK government has indicated that its NIS update will follow the EU’s lead in improving and streamlining the way in which cyber incidents are reported to regulators. Under NIS2, organisations must notify of any incident that has a significant impact on the provision of their services, for instance by causing severe operational disruption or financial loss. 

There is also plenty of focus in NIS2 on the cornerstones of sound cyber risk management – in particular the proper control of administrator-level account credentials, privileged access, and endpoints, all of which are prime targets for attackers.

Expanding The Scope

A number of new sectors are being pulled into the regulations, including space, waste management, research and development and a wider range of healthcare companies. Organisations are split into ‘critical’ and ‘important’ entities.

The burgeoning third party threat will also be addressed. Managed Service Providers (MSPs) are being added to the list of ‘critical entities’ to which the directive applies, in a move designed to keep the digital supply chains involved in the running of essential services secure. MSPs are often granted privileged access to corporate systems and networks, which creates security risks. Cyber criminals can take advantage of any vulnerabilities to attack and disrupt multiple organisations, as illustrated in the devastating MOVEit breach earlier this year. 

How Should You Prepare?

Organisations should take action now to establish whether the EU or UK NIS2 regulations will apply to them, and ensure they can implement and demonstrate best practice in good time.

They need to determine their obligations in relation to cyber risk management. What changes need to be made to existing processes, policies and practices to meet them? Are the basic cyber hygiene principles in place? As a priority, businesses must review their incident response plans and incident management and reporting procedures. It’s also a good idea to get a head start on undertaking third party security assessments, and incorporating security requirements into contracts. 

Given the framework’s focus on protecting privileged admin accounts, businesses should take measures to limit who possesses these powerful credentials – both across the organisation and within the supply chain. Implementing privileged access management (PAM) will allow IT to control who is granted access to which systems, applications and services, for how long, and what they can do while they’re using them.

It’s important that organisations engage now with the requirements of the updated NIS2, and build an understanding of what it means for them - especially those that weren’t covered by NIS1.

This should be viewed as more than just a compliance exercise. By adhering to the strengthened framework, businesses will build a foundation of resilience that protects the organisation, the services they provide, the communities that use them, and the wider UK economy from threats that could cause significant disruption and even endanger lives. 

Graham Hawkey is  PAM specialist at Osirium

You Might Also Read: 

Connected Devices Must Be More Secure:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« British Police On High Alert After Supply Chain Breach
Undetected Attackers Could Be Inside Your IT Systems Now »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CERT.GOV.AZ

CERT.GOV.AZ

Azerbaijan Government Computer Incident Response Team

StoneFly

StoneFly

StoneFly offers High Availability, high performance cluster and scale out storage, and backup and disaster recovery appliances.

Cyber Craft

Cyber Craft

CyberCraft is an innovative and dynamic software development, outsourcing and consulting company. Services offered include penetration testing.

CyberArts

CyberArts

CyberArts is founded on the belief that every single organization deserves and requires the creme de la creme when there is a need for Cyber services.

Mvine

Mvine

Mvine's primary business is authoring and selling Cyber-Secure Platforms for Collaboration Portals and for Identity Management as well as delivering cloud support services.

Swascan

Swascan

Swascan is the first all-in-one, GDPR Compliant, Cloud Security Suite Platform. GDPR Assessment, Web Application Scan, Network Scan, Code Review.

3B Data Security

3B Data Security

3B Data Security offer a range of Penetration Testing, Digital Forensics, Incident Response and Data Breach Management Services.

Ciphertex Data Security

Ciphertex Data Security

Ciphertex is a leading data security company that specializes in portable data encryption and privacy protection storage systems.

Emtec

Emtec

Emtec’s cyber security team provides advisory, assessment, & managed security services that help you build the cyber security policies, toolsets & best practices to elevate your cyber security posture

Hackurity.io

Hackurity.io

Hackurity.io is a high energy IT security start-up founded in 2021 out of the frustration that IT Security is highly fragmented and reactive.

Cybersecurity Dubai

Cybersecurity Dubai

Protect your business from cyber-attacks with Cybersecurity Dubai, your partner in online security solutions.

Quod Orbis

Quod Orbis

Quod Orbis are a fast-growing, innovative company providing market-leading expertise in cyber security and Continuous Controls Monitoring (CCM).

Google Safety Engineering Center (GSEC)

Google Safety Engineering Center (GSEC)

GSEC Málaga is an international cybersecurity hub where Google experts work to understand the cyber threat landscape and to create tools that keep users around the world safer online.

SecureLake

SecureLake

SecureLake (formerly Managni) is one of the most trusted US-based IT security and infrastructure companies.

Eclypses

Eclypses

Eclypses has a disrupting cyber technology, offering organizations an advanced data security solution called MicroToken Exchange (MTE).

WIIT Group

WIIT Group

WIIT Group are focused on a single goal: securing our clients’ critical processes and enabling them for digital transformation.