The NIS Directive 2 is a European Union law that aims to improve cybersecurity within the EU. It applies to all Member States and requires operators of essential services (OSE) and operators of critical services (OSC) to adopt adequate security measures to protect their computer systems and data.

What is the NIS Directive 2

The NIS Directive 2, which came into force on 17 January 2023, is a revision of the original NIS Directive (published in 2016) and introduces a number of new features. Let's look at the main ones.

Extending the scope of the regulation.. The new directive applies to a larger number of companies, including cloud service providers and companies that use large amounts of personal data.
Strengthening security obligations.. OSEs and OSCs are required to adopt more stringent security measures, including the obligation to carry out a risk assessment and to adopt incident response measures.
Greater involvement of supervisory authorities. A more active role is expected from supervisory authorities, who can impose sanctions on companies that do not comply with the regulations.

Which companies are required to comply with the new regulation

The NIS 2 Directive applies to two categories of companies.

Essential Service Operators (ESSOs):
are companies that provide services that are essential to society, such as energy, water, transport, banking, insurance and health.

Critical Service Operators (CSOs):
are companies that provide services that are critical to the economy, such as digital infrastructure, cloud service providers and companies that use large amounts of personal data.

Is your company among those that must comply with NIS 2?

Contact our team for a personalized consultation.

What to do to adapt

The Directive establishes that obliged entities must take appropriate and proportionate security measures to manage the risks that threaten the information systems and networks they use in their activities or in the provision of their services, as well as to prevent or minimize the impact of incidents on recipients of their services and on other services.

In summary, to comply with the NIS 2 Directive, companies must follow the following steps.

Risk assessment

The first step is to assess the security risk to which the company is exposed, for example through a vulnerability assessment.

Implementing adequate security measures

Based on the risk assessment, companies must adopt adequate security measures to mitigate the identified risks. It will therefore be appropriate to adopt a risk-based or multi-risk strategy.

Developing an Incident Management Plan

Individuals should create a Data Breach Recovery Plan, which details the procedures to be followed in the event of an incident.

Staff training

The company's staff must be trained in cybersecurity, in order to understand the risks and the security measures to be adopted.

Continuous monitoring and updating

Companies have the responsibility to constantly check the security level of their systems and be ready to adapt them quickly if necessary.

Penalties for failure to comply

Penalties for companies that do not comply with the NIS 2 Directive vary according to the severity of the infringement and may be pecuniary, prohibitive or otherwise. In Italy, they are applied by the Personal Data Protection Authority (AGPD) and include:

fines of up to 10 million euros or up to 2% of the company's annual global turnover, if greater than 10 million euros;
disqualification sanctions, such as a ban on operating in a certain sector or providing certain services.

Disqualification sanctions may be applied in cases of serious or repeated breaches of the obligations laid down by the legislation, for example:

failure to carry out a security risk assessment;
failure to take appropriate security measures;
failure to notify the notification bodies of a cyber incident that has a significant impact;
failure to provide information or documentation requested by the AGPD.

Main obstacles to effective implementation

The NIS 2 Directive has had a significant impact on the cybersecurity landscape. By forcing companies to deal with this issue, it has led to new thinking and a necessary increase in awareness of an increasingly fundamental issue. However, this is not a simple regulation. Let's look at the main obstacles to effective implementation.

The complexity of the legislation.
This is a complex legislation, which requires companies and organizations to review their business processes and radically change their mentality.
Lack of resources.
Implementation requires the investment of economic and human resources. This can be an obstacle for companies that operate in a difficult economic context or that have difficulty finding qualified personnel in cybersecurity.
Lack of awareness.
Information security has often been underestimated over the years and seen as a mere cost. Poor awareness on the topic often makes it difficult to understand the value of the activities and therefore correctly implement the directives necessary for compliance.

To overcome these obstacles, it is advisable to rely on cybersecurity professionals who can take on the role of partners in this important transition.

Soter as a NIS 2 Compliance Partner

The Soter team works alongside companies operating in sectors affected by the regulation on a daily basis, supporting them in the introduction of new processes with particular attention to resource optimization. In addition to having in-depth know-how in the cyber and offensive security field, we have a very clear vision of our role as professionals. We are in fact guided by the strong belief that it is necessary to develop a real culture of cyber security in companies. For this reason, in addition to a wide range of operational services, we offer training activities for employees and consultancy support to company managers.

Compliance with the NIS 2 Directive is a complex process that requires commitment from the company. However, it is a necessary investment to protect data and IT systems.

Request a consultation

Would you like to prevent cyber attacks against your company and provide a protected infrastructure for your customers? Contact us to assess the security of your business IT systems.