Will NIS2 cause a new GDPR moment? This is where we are today

October 18, 2024 will mark the start of a new phase in many companies’ cybersecurity journey. From then on, organizations will be presented with a clear timeline: by March 2025, relevant organizations will have to be registered with the relevant authority (e.g. for Belgium that is the CCB) and by April 2026 they must be compliant with NIS2 guidelines. Before April 2027, the aim is to have completed a first audit of the largest companies.

Despite the attention NIS2 has already received, and the many analyses and opinion pieces covering the topic, it is still not entirely clear what its precise impact will be – or how all pieces of the puzzle are supposed to fit together. Much will become clear only when each country has translated the framework into local law.

Still, contours are gradually becoming discernible and it is increasingly clear which direction organizations should take in terms of their cybersecurity posture. Although companies are still searching for the right measures to become 100% compliant, there are already some things that organizations can start with – and even should be doing. In many situations, Secutec can lend a much-needed hand.

Don’t buy snake oil

One thing organizations must understand: there is no miracle solution that will make companies, non-profits and other organizations compliant overnight. NIS2 is about an attitude that assumes an organization is doing what it should and can do, both to prevent incidents and to handle them correctly if one does occur.

Secutec offers many features that can play an important role on the road to NIS2 compliancy. Below is a schematic overview of the “Cyber Fundamentals Framework” that serves as the basis for implementing NIS2, and which Secutec solutions contribute to becoming compliant with each topic.

Secutec solutions touch on every category within the framework. Moreover, our services work seamlessly with the technology stack you already have in place. This means that organizations don’t have to purchase new hardware or overhaul existing structures to be able to take a big step toward compliancy.

Taking care of your reporting

Secutec offers you a portfolio of solutions that not only prevent issues, but also help you cure them. Our services and experts can play a major role both in reporting cyber incidents and in remedying their consequences. 

The greatest added value in this respect can be found on the Secutec Portal. All available data points, contextual insights and possible threat notifications are brought together together to show a complete and insightful picture of your company’s security posture. If suspicious data streams occur, or potential malicious domains are spotted, they are bundled into a clear list that can help in the creation of an incident report.

Don’t loiter

While it is tempting to wait until all the dots and commas are on paper, doing so can put your organization at a strong disadvantage. Those who do not start looking for solutions until the full localized framework is published will end up at the back of the queue. Given the tight timeline that the EU has in mind, this would be most unwise.

If the introduction of GDPR has taught us anything, it is that there is no advantage to be had by those who wait around. As is evidenced by the various fines issued daily to those who do not have their affairs in order. NIS2 will have a similar impact on the structure, approach and consequences for businesses across the European Union. Given the scale of the sectors impacted and the fact that the supply chain will also be in the crosshairs, few companies will escape notice.

Interested in a conversation about your needs and how Secutec can contribute to your specific company? Then contact one of our cyber experts soon.

NIS2, a brief reminder

As you might suspect, NIS2 is the successor to the first Network and Information Security Directive (NIS1) from 2016. This stated that companies and organizations, in sectors critical to society, must be compliant with established standards and rules. This framework is the same across the EU to avoid both cyber risks and unequal treatment of companies within the Euro zone.

NIS2 further tightens these rules and significantly expands their impact. For example, many more companies are now part of crucial sectors and companies in the supply chain are also coming into focus. Companies that meet certain criteria and do business with organizations in those sectors will also have to comply with NIS2. 

There is an impact both in terms of cybersecurity measures, notification requirements, risk management and business continuity requirements. In the event of an incident, you will have to demonstrate that the organization was prepared, that reporting is done correctly and that business operations are not compromised. To ensure this, there will be targeted audits from the relevant authorities.

More information can be found at https://ccb.belgium.be