The German industry association Bitkom published that data theft, espionage and sabotage cause the German economy an annual loss of around 203 billion euros. 45% of companies even believe that cyberattacks can threaten their business existence.
NIS 2: Need for action for many companies
The EU now wants to bring more resilience to the entire infrastructure and therefore launched the NIS 2 Directive on October 10, 2022. All EU member states must now transpose this into national law within 21 months. For many companies in Germany, this will result in considerable pressure to act by fall 2024. The question is no longer whether companies want to address the issue of cyber security, the question is how intensively they want or need to do so. One thing is clear: companies in Europe will have to meet a minimum standard of security in future.
What will change with the NIS 2 directive?
1. the number of sectors affected by the Directive has been extended.
A basic distinction is made between essential services and important services. 8 sectors have been newly added and some have been expanded.
Essential services:
- Energy
- Health
- Transportation
- Banks and financial markets
- Water and wastewater (new)
- Digital infrastructure / information and communication technology
- Space (New)
- Public administration (New)
Important services:
- Post and courier services (New)
- Waste management (New)
- Chemical production (New)
- Food (New)
- Processing/manufacturing industry (New)
- Digital services
- Education and research (New)
In addition, critical infrastructures will in future also include companies and organizations with 50 or more employees and an annual turnover of at least ten million euros, regardless of thresholds.
2. stricter reporting requirements
In the event of a security incident, the competent authorities must receive an initial report within 24 hours of becoming aware of the incident. A report on the incident must be handed over after 72 hours at the latest. This so-called “Indicators of Compromise” requires dedicated security expertise. A final report must also be submitted no later than one month after the incident, which must contain a description of the security incident as well as its severity - including the impact and the remedial measures taken. Risk management is therefore of particular importance.
3. stricter enforcement
Liability and fines have been significantly tightened and are based on the GDPR. Previously, sanctions were limited to 150,000 euros. In future, fines of up to 1.4 percent of annual turnover or 7 million euros can be imposed for essential services, in individual cases even up to 2 percent of annual turnover or 10 million euros. In principle, the company management is always liable for any infringements.
4. more powers for the supervisory authorities
The supervisory authorities have the option of regular and targeted safety audits, on-site inspections and ad hoc checks in the event of an emergency, including the performance of safety scans.
5. specifications for measures
To protect the IT infrastructure and networks of critical services, affected companies must implement the following security measures in future:
- Guidelines for risks and information security
- Emergency management
- Business continuity management
- Security in the supply chain
- Security in the procurement of IT and network systems
- Specifications for measuring cyber and risk measures
- Comprehensive encryption measures
- Use of multi-factor authentication and single sign-on
- Use of secure voice, video and text communication
What now?
Check now whether your company is affected. If this is the case, deal with the issue proactively and identify problem areas in good time so that you can take appropriate measures. An information security management system (ISMS) in accordance with ISO 27001 includes many of the requirements.
Meeting all requirements on time is likely to be a major challenge for companies that do not have an information security officer. It is worth seeking external support in good time.
Contact our security experts