NIS2: Security Requirements for Businesses

NIS2 requires entities that operate in the EU, fall into one of the regulated sectors and are bigger than the size cap for their industry, to:

The NIS2 Directive itself does not go into detail on what appropriate technical, operational and organizational measures look like. However, it does specify that risk management should follow an all-hazards approach and cover both digital and physical threats to IT security.

In addition, NIS2 names a few topics that organizations must address as part of their risk mitigation efforts: supply chain security, business continuity, incident handling, security awareness, encryption, access control and multi-factor authentication, among others.

On June 27 2024, the EU published a draft of a NIS2 Implementing Act which contains a detailed list of security requirements. This implementing act only applies to IT services like cloud computing providers, data centers or managed service providers, which are regulated directly by the EU instead of member states.

However, the act also serves as an effective preview of NIS2 security requirements. It is reasonable to assume that the final requirements for other industries will look quite similar, both in terms of which topics entities need to address and how strict the necessary safety measures need to be.

To comply with NIS2, organizations need to create an information security policy that outlines their approach for securing their network and IT systems. The security policy must establish security objectives and risk tolerance levels, as well as staff roles and responsibilities. It must also be appropriate to the overall business goals and provide the necessary resources for implementation.

The information security policy must be reviewed regularly and after significant incidents or changes to the IT infrastructure.

Regulated entities must also establish a risk management framework that identifies and addresses risks to IT systems. It must be based on a risk assessment and the management body must accept the results, residual risks and mitigation efforts.

Entities must communicate to their staff procedures for identifying, assessing and treating cybersecurity risks. This cybersecurity risk management process must be based on relevant criteria and follow an all-hazards approach. Where appropriate, it should also follow established European and international standards.

In addition, the risk management process must establish who is responsible for implementing risk management measures. Like the security policy, the risk management framework must be reviewed regularly and following major incidents or changes.

Organizations must also monitor their compliance with their own security policy (and smaller, topic-specific policies) through a compliance reporting system. Their security measures must be subjected to impartial internal reviews, avoiding conflicts of interest.

As part of their risk management process, entities must create an incident handling policy, which lays out the correct procedure for detecting and responding to potential security incidents.

The incident handling policy must:

Incident handling takes place in three stages: Containment, which prevents the incident from spreading further. Eradication, to stop the incident from continuing or reappearing. And finally recovery, to re-establish normal operations.

While handling an incident, response activities must be logged and relevant forensic evidence must be recorded. Following an incident, organizations must carry out a post-incident review to identify the root cause and apply lessons learned to reduce the likelihood of similar incidents. Emergency response plans must likewise be regularly tested and reviewed.

NIS2 requires organizations to monitor and log activities on their network and IT systems through suitable tools in order to detect possible incidents, respond quickly and mitigate their impact. Monitoring should be automated as much as possible, though the organization remains responsible for reviewing and classifying events.

Entities must maintain and review an event log that tracks things like:

The event log must be centrally stored, protected against unauthorized access and regularly backed up to prevent loss. In addition, entities must create a process that allows employees, suppliers or customers to report suspicious events.

As part of their NIS2 compliance, regulated entities must establish a business continuity and disaster recovery plan. This plan must be based on a risk and business impact analysis. It should include:

In addition, organizations must maintain backup copies of important information. These backups must be stored securely off-site and subjected to regular integrity checks. Companies must also ensure sufficient redundancies in terms of staff, facilities and IT systems. Backup copies and redundancies must be tested regularly to ensure they can be relied upon in a recovery scenario.

Supply chain security is one of the main areas of interest for the NIS2 directive. Businesses affected by NIS2 must create a supply chain security policy that governs their relationship with direct suppliers and service providers. Organizations must also maintain a directory of all direct suppliers and service providers, including a list of ICT products, services or processes provided by them.

As part of their supply chain security policy, organizations must set criteria for selecting suppliers, which must include:

In addition to these criteria, NIS2 establishes requirements for contracts and service level agreements (SLAs) with their suppliers. Organizations must specify:

Organizations affected by NIS2 have to minimize risks related to the acquisition of IT services and products critical to the security of their network and information systems. Businesses must:

When it comes to developing your own software, entities must ensure secure development processes for all development phases, from design to development, implementation, testing and maintenance. Development must also follow best practices like zero trust and security by design.

To ensure the safe usage of IT systems, regulated entities must ensure they are correctly configured, use malware protection and receive security updates in a timely fashion. Organizations must also follow procedures for change management and patch management, perform regular vulnerability scans and identify other issues through security testing.

Entities regulated by NIS2 must take appropriate measures to protect their network from threats. This requires up-to-date documentation on their network architecture, access controls within their own network, closing unneeded ports and access points, procedures for secure remote access and the usage of secure protocols.

On top of that, entities must use network segmentation to divide their network into different areas based on the security needs and risk analysis for different devices and processes.

Based on their risk assessments and prior incidents, organizations must establish a policy and procedures to assess whether their information security policy is effectively implemented. For this assessment, organizations need to define:

Businesses affected by NIS2 must educate their staff on security risks, the importance of cybersecurity and basic cyber hygiene practices. This requires regular training for both new and existing employees. Staff training must cover all relevant aspects of the information security policy and topic-specific policies.

For employees whose role requires additional skills and expertise related to cybersecurity, businesses must provide advanced training to cover the necessary information.

Depending on information sensitivity and asset classification, organizations must implement appropriate procedures for encryption, including the secure management of cryptographic keys where necessary.

Regulated entities must ensure that all employees, as well as direct suppliers and service suppliers, know, understand and follow security policies that apply to them, from the information security policy to topic-specific policies. Management bodies and users with privileged access likewise need to understand and follow their roles and responsibilities.

Obligations that remain valid after leaving the organization, such as confidentiality, must be explicitly stated in the terms and conditions of employment. Organizations must also put in place access control policies to ensure that access for former employees and suppliers is automatically revoked.

Organizations can require background checks before allowing employees to carry out certain roles and responsibilities. It is left up to organizations to determine which roles (if any) require background checks. Checks must be carried out in accordance with national and international laws and labor regulations.

NIS2 requires businesses to implement an access control policy in order to manage the access to IT systems for employees, guests, external accounts, apps and devices.

Through this policy, organizations need to manage the entire lifecycle of their digital identities. Accounts and their activities must be linked to a single person. Shared accounts can be used only when strictly necessary for business operations. Shared accounts also require explicit management approval.

Identities must be protected through secure authentication methods, especially multi-factor authentication. After repeated failed logins, accounts must be blocked and new credentials must be set. Admins must use separate accounts for system administration and normal activities.

Access rights must be assigned, managed and revoked based on best practices like the principle of least privilege and separation of duties. When an employee’s role changes or they leave the organization, access rights must be modified accordingly.

Access to network and information systems must be authorized by their owner. Access rights must be logged and regularly reviewed through so-called re-certifications or user access reviews. Access rights that are no longer needed must be removed.

As part of their NIS2 compliance, organizations need to securely manage information and other assets. To this end, companies need to establish an up-to-date inventory of all assets that support normal business operations. Changes to this inventory must be recorded in a traceable way.

In addition to inventorying assets, organizations need to establish a classification system and apply classification levels to all assets based on their required level of protection. Organizations also need to create a policy for handling assets that covers their entire lifecycle and includes instructions for safe use, storage, transport and destruction. Regulated organizations also need to ensure that exiting employees return all assets.

Moreover, regulated entities must create a policy for the usage of removable storage media. The use of removable media should be blocked on a device level, unless there is an explicit reason for their use. In this case, the automatic execution of files should be blocked and storage media should be scanned for malicious code prior to their use. Removable media must be controlled while in storage or transit and their contents must be protected through encryption where possible.

NIS2 follows an all-hazards approach, meaning that organizations need to protect against physical threats to their IT systems as well as digital ones. This includes preventing unauthorized access to facilities through access controls and physical security.

Companies must also protect against disruptions caused by utilities such as a loss of power, water, gas or internet supply. To ensure the continuous effectiveness of information systems, businesses need to monitor any controls necessary for the operation of the service, such as power, temperature and humidity control.

Finally, organizations must implement protections against environmental threats such as fire, flooding or lightning strikes.

The requirements of NIS2 are largely identical to the security norm ISO 27001. Given that both standards aim to provide comprehensive risk management measures to defend against both digital and physical threats, it shouldn’t come as a surprise that they end up addressing the same topics.

However, there are some important differences between NIS2 and ISO 27001:

NIS2 is an EU directive designed to improve IT security in essential services. It regulates entities with more than 50 employees in 16 different sectors. Experts estimate that roughly 150,000 businesses across the EU are affected by NIS2.

Aside from cybersecurity risk management, NIS2 also covers national cybersecurity agencies, the coordination of computer security incident response teams (CSIRTs) and EU-wide initiatives like the creation of cybersecurity certification schemes and a vulnerability database based on the CVE model.

NIS2 was already passed into law by the European parliament at the end of 2022. However, before NIS2 takes effect, member states first have to pass their own laws to enforce the directive on the national level. EU countries have until October 17 2024 to do so.

This means that on October 18 2024, compliance with the NIS2 Directive will become mandatory for regulated entities. That includes registering as an important or essential entity, implementing the required risk control measures and reporting significant incidents to the relevant authorities.

NIS2 creates cybersecurity requirements for important and essential entities, i.e. businesses and other organizations that are critical to the public and where a disruption of service would have significant impact on public life and the economy.

Whether businesses are considered important or essential depends on their size and the sector they operate in. Here’s a quick explainer:

To prevent businesses from having to fulfill multiple, overlapping regulations, NIS2 contains an exception for entities covered by sector-specific EU laws, such as the DORA Act in the financial sector.

For this exception to work, the law in question must cover all entities that NIS2 would apply to in the given sector, and it must contain security requirements and reporting obligations that are at least equal to NIS2.

NIS2 covers two different types of entities: essential and important. In general, the same security requirements, reporting obligations and fines apply to both essential and important entities. However, safety measures can be tailored to the scope of the organizations, since NIS2 follows the principle of proportionality. This means that the cost of implementation for risk management measures must be proportional to the entity’s size, exposure to risk and the likelihood of incidents.

An important difference between essential and important entities is in the NIS2 enforcement: Essential entities can be subjected to random checks and ad-hoc audits. Meanwhile, important entities are only audited when there is reason to suspect non-compliance.