23 January, 2023
In late 2022, the European Council approved NIS2, the updated version of the European security directives (called NIB2 in the Netherlands). This completes the approval process around the new directives. NIS2 has been in force since 16 January and includes, among other things, a broader reporting obligation regarding cyber attacks and stricter requirements around network and information security. European member states have until around 2024 to introduce new security rules for organisations themselves in line with the new directive.
What is NIS2?
NIS stands for Network and Information Security. NIS2 is the second version of the European NIS directive. The earlier version was already ratified by the European Parliament and the European Council in 2016. This led the Netherlands in 2018 to incorporate the directives into the Security, Network and Information Systems Act (W NBI). This law made it mandatory for certain Dutch companies to report cyber attacks and take certain security measures.
It will force an update of the national cybersecurity strategy in all member states. So too in the Netherlands. So laws and regulations on risk management, encryption and data incidents will become tighter in the near future. So it is high time to brush up on your network security.
Especially for fans of extensive international legal documents, the full text can be found here.
On which companies will NIS2 have an impact?
Currently, these rules only apply to organisations providing essential or vital services and digital service companies. Under the new requirements, the number of companies belonging to this group is going to increase significantly. Former head of Cyber Security at Defence and current MEP Bart Groothuis said the following about it:
"Anyone providing an essential service to consumers is covered by the new law. So also small service providers. We are still arguing about what exactly we mean by 'essential'." Internet service providers, small factories, companies dealing with water or energy: those kinds of companies will be considered essential."
What does the NIS2 directive mean for my business?
That depends on which classification you fall into. Are you not labelled as essential or important? Then you have no additional responsibilities yourself. However, you will have to follow the new national laws and regulations; they apply to everyone. Important, vital, essential or 'ordinary'. It is always advisable to keep your security in order.
In addition to the classifications essential and vital, the stamp 'important' will be added under NIS2. Companies in this category do not have to meet the most stringent security requirements, but they do have to report data breaches and cyber attacks.
So, depending on your line of business, your company may soon be under the microscope. Industries that need to pay extra attention to their cybersecurity and data protection include: healthcare, transport, energy companies and essential equipment manufacturers. A total of 16 sectors will be affected by the changes. Exactly which companies these will be will be determined by the central government. The National Cyber Security Centre (NCSC) will then act as a watchdog. They check whether companies comply with the requirements, and offer advice and support in meeting the security targets.
"It is not about whether you are part of the vital infrastructure. It's about whether a ransomware hacker finds you interesting enough for his business model. So cybersecurity is important for all entrepreneurs. Data breaches can happen at any time and to any business. As a business owner, you are always responsible for the customer data in your possession."
Companies that do get such a stamp will have to pay close attention. Fines for non-compliance are hefty; up to €10 million or 2% of annual turnover. Member state legislation must become "chefsache" according to the European Council. This means a company's director will be personally liable for any wrongdoing. Thus, the EU is signalling that they take cybersecurity seriously, and motivating management to do the same. So, dear CEO or SME, watch out:
Your business is 'Important'
Congratulations, you are important! You need to get to work on becoming NIS2 compliant. Take a close look at your information and cloud security, and start looking for weaknesses in your security. Not much of a hobby hacker? Then engage an IT partner to take a critical look at your security.
In major organisations, supervision will be enforced after the fact. This means that the state of your security is not proactively monitored, but you are responsible as soon as things go wrong. As an important organisation, you are obliged to report incidents such as cyber attacks and data breaches to the NCSC. Should it subsequently turn out that this incident was due to negligence or substandard information security, you will still face the consequences.
Your business is 'Essential'
After all, where would we be without your company? For essential businesses, security must always be in order from now on. You must first get certified by showing that your organisation meets the new requirements. After that, it is important to remain compliant as well. So keep your security up to date! Are you not doing this and do you receive an unannounced visit from a regulator? Then a slap on the wrist will follow.
For an honest mistake, a warning is expected to follow first, after which you do have to resolve the mistake immediately. For bigger offences and unacceptable negligence, however, an immediate fine is permissible. This method of deterrence and constant vigilance is necessary because the IT landscape of essential service providers is constantly changing. So tight attention must be paid to ensuring that security systems remain up-to-date and comprehensive.
How to prepare properly for the NIS2 directive?
As it is not yet certain what form the measures the Netherlands will take will take, we cannot offer a comprehensive answer here. What we do like to offer is tailor-made advice and adoption. Here are some best practices to be well prepared for the coming changes.
- Get to know the NIS2 guideline: Check whether these apply to your organisation. Are you an operator of essential services or digital service provider? Then it is important to get to know and, more importantly, start understanding the requirements that apply to your business.
- Check your current security: What state is the security of your network and information systems currently in? Your goal here should not be to compliment yourself for 'good enough'. Start looking for something to improve. Look not only at your IT, but also at the human processes around data protection. Do risk factors appear in your security? Then address them immediately and plug the bigger holes first.
- Make clear agreements: Once you have reviewed current security, you can develop a plan to become NIS2-compliant. Take new security measures and update existing ones so that they are up-to-date. Policy-wise, you can fine-tune human processes, or develop whole new procedures.
- Engage in conversation: Security is never something you do alone. Every employee should be aware of any changes in practices or expectations. Perhaps they can still offer relevant feedback around your security! We also recommend keeping in close contact with customers about any implications and for gathering valuable feedback. Regulators and partners in IT can offer you valuable advice.
- Stay vigilant: NIS2 compliance will be an ongoing process. Keep abreast of the latest developments around cybersecurity to stay ahead of nasty surprises or dated security measures. Monitor and evaluate your information security regularly, improve where necessary and keep evolving.
NIS2 in the Netherlands
Now that the final directive has been approved, European member states themselves have to work on adapting national laws and regulations to it. They have until early 2024 to do so.
Our little country already started tightening the laws around cyber security last July. At the time, the Ministry of Economic Affairs announced the extension of the WNBI. Since then, stricter rules are already in place for multi-tenant data centres and large DNS service providers. The laws around each vital sector will be taken up in the coming year.
Want to know more or need help?
In this blog, we briefly told you about the changes around NIS2. Have we been able to help you a little further? Do you doubt whether your network and information security is in order? Then we would be happy to help you out. If you would like a non-committal chat or are interested in our security or managed services; feel free tocontact us at .