With just one year before the EU’s updated Network and Information Security Directive (NIS2) comes into force, a concerning lack of preparedness is evident among organizations in the UK, France, and Germany. NIS2 aims to address the rising cyber threats and increased reliance on digital systems, expanding its reach to encompass more industries and entities. This article explores the level of preparedness, specifically focusing on the unpreparedness in the UK, the significance of securing supply chains, potential penalties for non-compliance, the background of NIS2, its scope, compliance timelines, the importance of learning from past experiences with GDPR, and a call to action for organizations to prioritize cybersecurity preparation.
Lack of preparedness in the UK
Among the three countries surveyed, UK organizations show the lowest level of preparedness for NIS2 compliance. Shockingly, three quarters of UK organizations are yet to fully address the five key requirements for compliance outlined in NIS2. This concerning lack of readiness poses a significant risk to these organizations if they operate within the EU, necessitating immediate action to avoid potential penalties and reputational damage.
Supply chain security
According to Sailpoint’s findings, a staggering 80% of the UK organizations surveyed need to improve their supply chain security. The importance of securing supply chains cannot be understated, as they serve as potential entry points for cyber attacks and can jeopardize the overall network and information security of an organization. NIS2 places a strong emphasis on supply chain security, necessitating robust measures to protect against cyber threats.
Penalties for Non-Compliance
Failure to comply with NIS2 carries severe consequences. Organizations found in breach of the directive can face fines of up to €10 million ($10.5 million), or 2% of their global annual revenue. These penalties serve as a stark reminder of the financial repercussions associated with non-compliance. In addition to financial consequences, organizations not compliant with NIS2 risk reputational damage, loss of customer trust, and potential disruptions to their operations.
Background on NIS2
NIS2 is an updated version of the original NIS directive, which was passed in 2016 and became law in most EU member states in 2018. This update reflects the ever-increasing reliance on digital systems and addresses the evolving cyber threat landscape. NIS2 expands the scope of the directive to include a broader range of industries and entities, ensuring a more comprehensive approach to network and information security across the EU.
Scope of NIS2
NIS2 applies to organizations with over 250 employees and an annual turnover of €10 million or more. With these criteria, NIS2 encompasses a wide range of organizations, from small to large enterprises across various sectors. It is crucial for organizations falling within this scope to ensure they are compliant with NIS2 requirements to safeguard their networks, information, and overall cybersecurity posture.
Timeline for compliance
NIS2 was enacted in January 2023, signaling the start of the countdown for organizations to comply with its provisions. The deadline for member states to transpose NIS2 into their national laws is set for October 17, 2024. With just one year remaining, organizations must act swiftly and decisively to navigate the complexities of NIS2 requirements and align their cybersecurity practices accordingly.
Lessons from GDPR
The implementation of the General Data Protection Regulation (GDPR) in 2018 served as a valuable lesson for organizations preparing for NIS2 compliance. Many organizations struggled to meet GDPR requirements and faced significant challenges in protecting personal data adequately. It is crucial not to repeat these mistakes with NIS2. Organizations should leverage the lessons learned from GDPR to enhance their cybersecurity preparedness for NIS2 and avoid potential pitfalls.
As the deadline for the EU’s NIS2 looms, organizations in the UK, France, and Germany must urgently address their lack of preparedness for compliance. With significant fines and potential reputational damage at stake, organizations need to prioritize securing their supply chains, aligning with NIS2 requirements, and investing in robust cybersecurity practices. By learning from past experiences and taking decisive action, organizations can navigate the changing cybersecurity landscape effectively and protect themselves from emerging cyber threats. The time to act is now – don’t wait until it’s too late.