CYBER AWARENESS: NIS2 – THE TIME HAS COME Do you know your obligations?

What is NIS2?
The NIS2 Directive is an EU regulation designed to improve the cybersecurity resilience of businesses and organizations providing essential and important services, including sectors like energy, healthcare, transport, financial services, and digital infrastructure. It aims to address the gaps identified in the original NIS1 directive by:

Expanding the scope of regulated entities: NIS2 covers more sectors, including medium-sized businesses and key sectors such as public administration, digital services, and waste management.

Harmonizing requirements across the EU: NIS2 aims to standardize cybersecurity measures across member states, ensuring a more consistent approach to cybersecurity within the EU.

Strengthening enforcement and oversight: It enhances the powers of national authorities to monitor compliance and respond to cyber incidents more effectively.

Key Differences Between NIS2 and NIS1
While both directives focus on improving cybersecurity, there are significant differences between NIS1 and NIS2:

Broader Scope: NIS1 primarily targeted operators of essential services (OES) and digital service providers (DSPs) in sectors like energy, healthcare, and transport. NIS2 expands this to include a broader range of “essential and important entities.” It covers medium-sized businesses and introduces new sectors such as space, public administration, food supply, and digital communications.

Clearer Risk Management Requirements: NIS1 had a more general requirement for implementing “appropriate and proportionate” security measures.
NIS2 introduces clearer and more specific requirements, including measures for incident detection, response, business continuity, and crisis management.

Incident Reporting: NIS1 required organizations to report incidents that had a significant impact on the provision of their services.
NIS2 broadens the reporting obligations to include any incident that could disrupt services or cause significant operational or financial harm. It also introduces stricter deadlines for reporting incidents (24 hours for an initial report and 72 hours for a more detailed assessment).

Increased Regulatory Powers: Under NIS1, national authorities had varying degrees of enforcement power across EU member states.
NIS2 standardizes enforcement and provides national regulators with enhanced powers to impose penalties, conduct audits, and enforce compliance.

Stronger Supply Chain Security: NIS2 emphasizes the need for businesses to secure their supply chains, particularly when relying on third-party service providers. This is more stringent compared to NIS1, which had fewer provisions about supply chain management.
Compliance Obligations for UK Small Business Owners
Even though the UK has left the EU, NIS2 is still relevant for UK-based Small Businesses that operate in sectors critical to national infrastructure or provide services to the EU. UK businesses need to understand that NIS2 may apply if:

They provide services to EU member states in sectors regulated by NIS2 (e.g., digital infrastructure, healthcare, finance, and transport).
They are part of the supply chain for an essential or important entity in the EU. Key obligations for UK small business owners under NIS2 include:

Implementing Cybersecurity Measures: Small businesses must implement cybersecurity risk management practices that cover incident detection, response, recovery, and ongoing monitoring. This includes ensuring business continuity during a cyber incident and addressing third-party risks in the supply chain.

Incident Reporting: Businesses must report significant cybersecurity incidents within strict timelines—typically an initial report within 24 hours, followed by a more comprehensive report within 72 hours.

Supply Chain Management: Small businesses must ensure that their suppliers and third-party providers meet the same cybersecurity standards required by NIS2. This includes conducting due diligence and incorporating cybersecurity clauses in contracts with suppliers.

Collaboration with Authorities: Small businesses must cooperate with regulatory authorities in both the UK and the EU, sharing information about cyber threats and incidents. They must also participate in national or sector-specific cybersecurity programs, if applicable.