NIS2 Directive. New Cybersecurity Guidelines – NIS2 Directive

30.01.2024
Cybersecurity

Network and Information Security 2 is an amendment to the NIS Directive, which addresses cybersecurity issues. Although the second edition has already entered into force, each member state has until October 17, 2024, to implement the regulation into its national legal system. This means that a Polish law will be in force by that date, and a new cybersecurity standard and strategy will be in effect in Poland from October 18 of this year.

The NIS2 Directive is a significant step in the field of cybersecurity, which has become increasingly important in recent years due to evolving and emerging threats. It was developed precisely for this purpose, aiming to strengthen the protection of critical infrastructure and ensure the security of data and IT systems. It is intended to harmonize IT security standards, leading to a more efficient response to cyberthreats.

Who does NIS2 apply to?

The Directive explicitly defines two groups of entities that have a significant impact on the functioning of the state. These are key entities and important entities, and the grouping of specific entities is detailed in the document. Key entities refer to those from the sectors defined in Annex 1 that exceed the SME threshold, including organizations from the following areas:

  • energy,
  • transportation,
  • banking,
  • financial market Iinfrastructure,
  • healthcare,
  • drinking water,
  • wastewater,
  • digital infrastructure,
  • inter-business transaction management (ICTR) services,
  • public administration entities,
  • space.

In addition, the following are also considered key players:

  • trust service providers and top-level domain name registries,
  • DNS service providers,
  • providers of public electronic communications networks,
  • providers of publicly available electronic communications services exceeding the SME threshold,
  • entities defined as critical in the Critical Entity Resilience Directive (EU) 2022/2557.

Critical entities are those identified in Annex 1 but not exceeding the SME threshold. The list is also supplemented by sectors defined in Annex 2, including entities from the following industries:

  • postal and courier services,
  • waste management,
  • production, manufacturing, and distribution of chemicals,
  • production, processing, and distribution of food,
  • production of:
    - medical devices and in vitro diagnostic medical devices,
    - computers, electronic, and optical products,
    - electrical equipment,
    - machinery and equipment not elsewhere classified,
    - motor vehicles, trailers, and semi-trailers,
    - other transport equipment.
  • digital service providers,
  • scientific research.

It's worth noting that, in the case of national legislation, the group of entities subject to the new regulations may be expanded. Each member state will establish a list of all key and important entities by April 17, 2025. The list may also be updated at most every two years.

What does NIS2 require?

The directive introduces a number of changes and obligations that both states and entities covered by it must meet. A key obligation for EU members is the creation and adoption of a national cybersecurity strategy and the appointment of bodies (known as CSIRTs) tasked with managing the cybersecurity system in the country, communicating with counterparts in other countries, and handling incidents reported within entities. It's important to remember that these institutions aren't solely responsible for overseeing and penalizing; their primary goal is to support organizations in improving their security standards and to thoroughly analyze reported incidents. These incidents can also be reported by entities not subject to NIS2 but requiring support in resolving issues resulting from an attack. Such bodies have already been established in Poland.

Each entity covered by the directive must ensure its IT and OT security system is in place to ensure adequate infrastructure security in the areas specified in the directive, including at least:

  • IT systems risk analysis and security policy,
  • incident handling,
  • business continuity, e.g., backup management and disaster recovery and crisis management,
  • supply chain security, including security aspects related to the relationship between each entity and its direct suppliers or service providers,
  • security in the acquisition, development, and maintenance of networks and IT systems,
  • including vulnerability management and disclosure,
    policies and procedures for assessing the effectiveness of cybersecurity risk management measures,
  • basic cyber hygiene practices and cybersecurity training,
  • policies and procedures for the use of cryptography and, where appropriate, encryption,
  • human resources security, access control policy, and asset management.

Jak postępować według NIS2?

A properly designed environment should guarantee protection against cyber threats and thus help prevent an incident. However, if one does occur, it must be handled appropriately. This means reporting the incident to the relevant authority within the statutory timeframe, cooperating with the authority, and jointly striving to minimize its negative impact. Each entity covered by the regulations will also be subject to an audit of its security measures. Detailed procedures are set out in the directive and will also be described in detail in the act.

  • For key entities – €10,000,000 or at least 2% of the total annual global turnover in the previous financial year;
    For important entities – €7,000,000 or 1.4% of the total annual global turnover in the previous financial year.

Furthermore, non-compliance with the regulations may lead to the suspension of the entity's business license or the imposition of a temporary ban on the exercise of management functions by an individual in the position of CEO or legal representative.

Summary

The amended directive requires organizations that are subject to it to analyze their environment and the solutions they use. The legislator does not explicitly specify the standard for the required tools, only stating that they should be proportional to the level of risk exposure, its magnitude, and the likelihood and severity of an incident. However, based on the presented guidelines, it is easy to build a pool of technologies whose implementation will significantly simplify not only security management but also incident handling.


Related articles