Understanding EU's NIS2 Cybersecurity Directive

An increasingly digitized world with growing digital connectivity brings enormous opportunities and attack paths for cyber criminals to exploit. In parallel, the number, complexity, and scale of cybersecurity incidents and their economic and social impact are growing. Supply chains are more interconnected, and a security breach at an entity significantly impacts an entire region or industry. The EU is increasing the security risk management requirements for the region to protect the digital landscape.

At the end of 2022, the European Union published the final version of “Measures for a high common level of cybersecurity across the Union,” also called “NIS2”. This is the successor of the “Network and Information Security Directive” (NISD), which was released in 2016. The directive provides legal measures to improve overall cybersecurity across the EU. This includes obligations for businesses, government authorities, and cooperation between EU member states on security risks and incidents. The differences between the NIS2 draft version (released in 2020) and the final version are significant, and this paper refers to the final version.

This document’s purpose is to provide an overview of the final NIS2 directive. Our second whitepaper provides practical advice and security measures for incident detection/reporting and OT security based on an EU member state’s recently published methodology update.

Management Summary NIS2

The NIS2 directive will become effective across all EU Member states by 17. October 2024. All requirements apply for entities of specific sectors and business sizes that are active in one or more EU member states. For a business to be in scope, the entity has to engage in economic activities, irrespective of its legal form. Major suppliers for clients in the EU will also be in scope if their clients are in the EU and receive critical services.

Key aspects of NIS2:

• A new level of reliability: Frightening and painful fines and penalties for repeated non-compliance are intended, up to temporary suspension of C-Level/board member
• More industries: Supervision and enforcement by local authorities for medium and large organizations across more than a dozen key sectors
• Minimum requirements: Establish mandatory, reviewable, and sanctionable cyber security measures for incident reporting and risk management, response/remediation required. EU member states can define stronger requirements for their region
• Supply chain included: Requires risk reviews of security practices for major connected 3rd party services providers; this includes, e.g., Managed Security Services providers
• Government support: Entities without adequate security staffing can ask for help in case of a major incident
• Maximum fees: Defined by member states but has to be at least 1.4% of global turnover or €7M for important entities, 2% of global turnover or €10M for essential entities

The expected impact:

• Gain in security maturity insights across EU Member states: Expect government authorities to develop a good understanding of effective measures in your industry and raise the expected security maturity to a common level.
• Efficient management of risks required: Adding active risk management measures will add cost/time efficiency pressure to the organization as it requires not only to detect but to continuously assess and respond to risks.
• NIS2 is not the end: Cybersecurity maturity is a strategic target of the EU commission, and in parallel to NIS2, additional initiatives are underway. An increase in requirements and fines can be expected.
• Recently published measures from an EU member state we discuss in Chapter II indicate NIS2 compliance will require a significant increase in security maturity (approx. CMM level 3-4), requiring better understanding and actively managing risks, not only covering incident detecting but also taking remediation actions, and measures the outcome and security management efficiency.

Suggested actions:

• Review your compliance: Assess security risks based on all relevant assets, review your security risk management and incident detection and response management capabilities, and define local/regional (EU)/global responsibilities. There are solutions like Verve that can help to evaluate and resolve security issues.
• Close gaps: Identify OT-accepted security solutions based on their security coverage, work efficiency, and operational costs. Get a demo and run a pilot before selecting a vendor. There are OT security solutions for different maturity available; go with the one that covers regulatory compliance as well as internal requirements. Keep in mind you will probably need to grow into a higher maturity level over time, make sure the investment is sustainable, and the solution doesn’t have to be replaced after two years because requirements have increased. The more integrated the solutions are, the more efficient (time/effort/cost) is the security management.
• Prepare for expected security controls: As of today, the expected measures in detail have not been published. ENISA, the European cyber security agency, released a mapping of NIS2 requirements to global security standards. For a first idea of to be expected security controls, we mapped expected NIS2 measures with the 2023 version of the security compendium from German BSI in chapter II of this document. We also mapped the BSI controls with our security solution, which is built by control systems engineers and allows clients to gain deep security insights on their OT assets, allowing them to make informed decisions and act on events in an OT-accepted, cost- and time-effective way.
• Note to CISOs and board members: Be aware of what’s coming, not only because you can be held personally responsible but also because the EU is on its way to building and enforcing a major and rather complex framework of security compliance regulations across all member states. If organizations fail to take the initiative, the initiative will be taken by government authorities which can cause stress to your organization.

NIS2 and important related regulations 2023/2024

NIS2 is part of the EU’s cybersecurity strategy and complements other directives and laws. Especially relevant for operational environments are the Critical Entity Resilience (CER) directive, which is closely interrelated with NIS2, and the EU Cyber Resilience Act (ECRA). Both have significant consequences for vendors, operators, and service providers of operational equipment; ECRA becomes effective at the end of 2023.

CER Directive (final):

Finalized and transposed in parallel to the NIS2 Directive, together they address digital cyberattacks (NIS) to physical attacks and natural disasters (CER). CER focuses on physical rather than digital resilience measures for critical entities. National authorities perform reviews and assess the effectiveness and accountability of the risk management process; they can also provide significant support to entities. Both directives become effective by October 2024.

EU Cyber Resilience Act (ECRA):

Becomes legally effective End of 2023 and is focused on regulating a broad range of digital devices, their hardware, and solutions with embedded software and applications. It imposes obligations on manufacturers, importers, and distributors of these products across their life cycles. It also defines essential requirements for the design, development, production, and operation of digital products and adds requirements for vulnerability and incident handling for manufacturers and obligations for operators.

ENISA’s 2023 report uses NIS-based reported data

To improve cybersecurity and create risk awareness, ENISA publishes an annual threat landscape report that includes NIS-based incident reporting information and globally gathered incident data. A recently released 2023 report for the transport sector shows a targeted system that includes OT for the first time (left image) and observed incidents across all sectors (right image) and concludes for 2022, once again, an increase of ransomware, impacting vulnerable and unpatched systems.

What does the coverage of OT mean for the organizations in scope?

We know there is already a skills shortage in cybersecurity and especially for OT, but there is a notorious lack of experts with a combined industrial operational risk understanding and security expertise. Entities and regulators must find ways to identify and evaluate the most efficient, automated, and integrated approaches for continuous and active management of risks, including OT. NIS2 will require organizations to understand their risks and actively manage their security measures. A one-time, project-based security investment into a single-dimensional technology without proper management integration will not be sufficient to cover the increasing requirements. Especially for operational environments, entities will either acquire new security solutions for each maturity increase step they take or invest in higher maturity solutions they can grow with and into. The last approach is more effective; the other is slower and pricier. As some entities are regularly audited, effective and valuable approaches to OT security will quickly become visible to authorities.

Who is in scope?

The last NIS2 update added a new level of flexibility to who is in scope. Added flexibility for regulators allows entities to move between weaker and tougher requirements sets; unfortunately, it also adds complexity for entities to determine if they are in scope.

Scoping elements:

• Medium and large-sized entities that provide or carry out services within the Union and are active within the sectors of NIS2 Annex I or II
• NIS2 Annex I or II type entities of any size when the entity is
  • critical because of its specific importance at the national/regional level for the particular sector or type of service or for other interdependent sectors in the Member State
  • The entity is the sole provider of services in the member state, and service is essential for the maintenance of critical societal or economic activities
  • Trust services, public communication network provider, DNS
• NIS2 Annex I + II type entities of any size when a service disruption
  • could have a significant impact on public safety/security/health
  • could have significant systemic risks, especially for sectors where disruption could have a cross-border impact
• Member states may include critical research activities

NIS2 distinguishes between essential and important entities. Essential entities have increased security requirements and face stricter supervision and higher penalties. See the image below for major requirements; we will provide more details later on:

At some point, you will be able to reach out to ENISA for clarification; the EU agency will create and maintain a registry for essential and important entities for NIS2. Until then, you can perform a precheck to determine if you could be in scope. Because the methodology is rather complex (and flexible to be extended for the EU Commission), we provide a quick check-up chart:

To perform a pre-check if you are considered an essential or important entity, you need to know the following:

• Is your industry/subindustry listed in Annex I or II?
• (see table below)
• your company size (see image right)

Annex I sectors:

Annex II sectors:

If your sector or company size is not on either list, you may still be in scope if:

• You are a major services provider to a client that is considered in the scope of NIS2. In this case, you will not face mandatory duties but will require some cybersecurity practices, like a defined process for vulnerability disclosure and communication with the client. Providers of managed security services are in scope.

Member states can exclude areas of defense, national security, public security, or law enforcement from the requirements of the directive.

NIS2 compliance requirements

Duty to provide entity contact details:

All entities in scope must provide contact details:

• Initially notify ENISA of your entity name, addresses of main and other legal establishments in the EU, up-to-date contact details, including email addresses and telephone numbers
• Foreign corporations not established in the EU but providing services (e.g., data center and content and service providers) must provide a designated representative contact
• Update of changes within three months the change became effective

Reporting obligations for a potential severe incident:

All entities in scope must report severe incidents. Local government, authorities, and CSIRT support and information sharing across entities are one of the main areas of regulation. The importance of the topic is reflected in tight deadlines and can become subject to sanctions. A notification does not make the notifying entity subject to increased liability.

A severe incident that must be reported to local authorities or the CSIRT is characterized as:

• severely impacting services, or
• imposing a significant financial loss, or
• significant immaterial or material impact on a natural or legal person

The EU is building tools to support the reporting process and allow quick escalation and support of the incident response. Entities can ask to be supported by authorities.

Who and when to notify?

• The national competent authority or CSIRT
• Recipients of the services (incidents and potential incidents)
• Without undue delay, within 24 hours after having become aware of the incident

A final incident report must be sent no later than one month after the submission of the incident notification. It must at least include:

• A detailed description of the incident, its severity, and its impact
• Type of threat or root cause that likely triggered the incident
• Applied and ongoing mitigation measures
• Whether the incident has a cross-border impact or is caused by unlawful or malicious action

In Chapter II, we will discuss how incident handling measures can be expected to look based on the recently released EU member state security methodology.

Minimum security risk management measures:

Like NISD, NIS2 only provides a minimum mandatory set of measures to cover. These are not necessarily interconnected or even directly related. In many cases, additional steps, processes, or security functions lay in between. Security measures are not specified in detail. This is normal for EU directives; they only describe a broad outcome and allow national legislations to choose the desired level of detail they regulate. Later, there will also come an implementing regulation for NIS2 with more detailed requirements, which are binding to the Member states. The following list contains minimum mandatory areas of coverage for all entities; exceptions are mentioned.

All entities must take effective, appropriate, and proportionate technical and organizational measures to manage the cybersecurity risks posed to the security of networks and systems. These measures shall ensure the level of security is related to the risk presented. All measures and respective non-compliance are accounted for by management.

The following measures represent the minimum requirements to be covered:

• Asset management
• Basic cyber hygiene practices and cybersecurity training
• Incident handling (we discuss potential expected measures in Chapter II)
• Policies for risk analysis, information system security, and access control
• Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
• Business continuity, such as backup management, disaster recovery, and crisis management, are in place
• Supply chain security, incl. security of relationships between the entity and its direct suppliers/service providers, are in place and considered
  • vulnerabilities specific to each supplier/service provider, and
  • product quality and cybersecurity practices of their supplier, including secure development procedures
  • results of coordinated security risk assessment of critical supply chains
• Security in network and information systems lifecycle, including vulnerability handling and disclosure
• policies and procedures regarding the use of cryptography and, where appropriate, encryption
• Use of multi-factor authentication or continuous authentication solutions, secured voice, video, and text communications, and secured emergency communication systems within the entity, where appropriate

Quick checklist for the first steps:

• Relevant assets are detected to a very high degree within an appropriate timeframe. This also applies to OS-based and embedded systems in OT.
• Security policies are documented, communicated, and assessed.
• Is a process to report potential significant incidents in place?
• Assets in scope have been identified, are monitored, and are vulnerabilities and threats managed?
• The entity is capable of identifying, monitoring and alerting and possessing capabilities to respond to a threat.
• A ticketing system to manage and document incident detection triage and response is in place?
• Critical processes and their assets are known and documented, and security measures are in place.
• Supply chain risks are identified, and mitigating measures are in place.
• Can evidence from a security management system be relied on for industrial assets?

An overview of a timeline with preventive and detective risk management measures (A3), a security incident, and the following reporting duties (A2) was provided in the presentation we gave on the final NIS2 directive.

Supervision, enforcement, fines, and penalties

As a general rule, essential entities are subject to a stronger supervisory regime, while important entities are subject to lighter supervisory: They have no initial obligation to systematically document compliance with cybersecurity risk management requirements up to the point of a major incident or threat happens. At that point, they will be supervised, face enforcement of violations, and can be subject to fines and penalties.

Supervision:

Essential and important entities face equal baseline measures. Additional requirements for essential entities will be covered in the next paragraph.

Supervision all entities in scope:

• Is coordinated with the legal representative of the entity
• Includes on-site inspections
• Includes off-site inspections
• Authority can request information to assess compliance
• Authority can request evidence of security policy implementation

Additional supervision for essential entities covers:

• Regular and ad hoc audits, including a collection of evidence
• Random, unplanned checks by authorities

Enforcement of violations:

Should the supervision identify compliance violations, enforcement will come into effect. Again we will separate baseline enforcement from enforcement for essential entities alone.

For all entities in scope, local authorities can

• issue warnings
• issue binding instructions to remediate incidents within the deadline
• order to cease and make infringing public, provide guidance
• order to implement security audit recommendations within the deadline
• impose administrative fines

Additional enforcement for essential entities includes:

• Initiate temporary prohibition to exercise managerial function at the CEO or legal representative level
• Designate a monitoring officer to oversee compliance
• Issue binding instructions to prevent incidents with deadlines for implementation and reporting

When issuing enforcement actions and penalties, both entity types authorities must consider

• the severity of the infringement, such as
  • repeated violations,
  • failure to notify or remediate significant incidents/binding instruction,
  • obstruction of audits or monitoring activities,
  • providing false or grossly inaccurate information
• the duration of the infringement
• previous infringements
• the material/non-material damage caused and users affected
• any intent or negligence
• measures are taken to prevent or mitigate damage
• the level of cooperation

Penalties and fines:

The directive states multiple times that penalties defined by each member state must be effective, proportionate, and dissuasive.

For all entities in scope, local authorities can

• impose periodic penalty payments to cease infringement
• additional sanctions (effective by Jan 2025)

Important entities face maximum penalties of at least 1,4% of global turnover, or €7M, whichever is higher.

Essential entities face maximum penalties of at least 2% of global turnover, or €10M, whichever is higher.

How Verve helps with NIS2

One of the major changes for entities in the scope of NIS2 is the requirement to actively manage risks and not only detect and document but also remediate them. The image below shows Verve’s unique capability to collect rich, asset-related security information, which helps to detect risks as well as incidents (left circle) and the capability to remediate incidents as the Verve platform enables organizations to actively take informed actions to remediate risks and incidents.

Taking action is provided in a sophisticated way that reflects the reality of most security departments in OT: Limited personnel and limited expertise. Risk data related to incident causes are collected through the OT environment (data arrow up). The data is then analyzed, and a strategic and methodical (global/regional or local) response is orchestrated by a small expert team. The suggested response action is prepared and suggested to the local operations team before it is executed (actions arrow down), and the local field level stays in control.