NIS2: a new step for European cybersecurity
The European NIS2 directive strengthens cybersecurity requirements for many organisations operating in sectors considered essential or important.
Its goal: to strengthen organisations’ ability to prevent, detect, manage and limit cybersecurity risks and incidents.
But NIS2 is not just about installing technical solutions.
It requires a comprehensive approach combining governance, risk management, security measures, incident management, business continuity, supply chain security and access control.
The first question to ask is therefore simple:
Where do we stand today against the NIS2 requirements?
Are you affected by NIS2?
Before putting a compliance plan in place, it is essential to determine whether your organisation falls within the scope of the directive.
NIS2 applies in particular to entities operating in various critical and important sectors, with criteria relating mainly to their activity and, in some cases, their size.
The exact scope, however, depends on the nature of the organisation, its sector of activity and how the directive has been transposed into the applicable national law.
Being affected by NIS2 is the first question. Measuring your level of preparedness is the next.
NIS2: a comprehensive approach to cybersecurity
NIS2 introduces an approach based on risk management.
The areas covered include:
- analysis and management of information system security risks;
- incident management;
- business continuity and crisis management;
- supply chain security;
- security in the acquisition, development and maintenance of systems;
- vulnerability handling and disclosure;
- access control policies;
- the use of cryptography;
- human resources security;
- awareness and training;
- assessment of the effectiveness of cybersecurity measures.
The challenge is therefore not just to have security technologies, but to be able to demonstrate that risks are identified, addressed, monitored and controlled.
ISO 27001 and NIS2: the same risk management logic, but not the same objective
A question often comes up:
“Is a company certified to ISO/IEC 27001 automatically compliant with NIS2?”
No, not automatically.
ISO/IEC 27001 provides a structured framework for establishing, implementing, maintaining and continually improving an information security management system (ISMS).
An organisation already committed to ISO 27001 therefore generally has some of the necessary mechanisms in place: governance, risk analysis, policies, controls, responsibilities, monitoring and continual improvement.
But NIS2 introduces requirements and obligations that must be analysed according to the context and scope of each organisation.
It is therefore necessary to identify the gap between the existing set-up and the applicable NIS2 requirements.
The transition can be represented simply:
Existing ISMS / ISO 27001
↓
Analysis of applicable NIS2 requirements
↓
Identification of gaps
↓
Action plan
↓
Implementation of measures
↓
Monitoring and continual improvement
The goal is therefore not to start from scratch, but to build on what already exists and methodically address the gaps identified.
The “NIS2 gap”: what really needs strengthening?
Each organisation has a different level of maturity.
Some already have a structured ISMS or ISO 27001 certification. Others have put several cybersecurity measures in place without a formalised management system. Others are just starting out.
The gap may relate in particular to:
Governance
Responsibilities, policies, steering and risk management.
Technical protection
Network security, access control, protection of systems and applications.
Incident management
Detection, response, notification and lessons learned.
Continuity
Resilience, backups, recovery and crisis management.
Suppliers
Assessment and control of supply chain risks.
Vulnerabilities
Identification, treatment and monitoring of vulnerabilities.
Evidence and steering
Documentation, indicators, controls and assessment of the effectiveness of measures.
The level of preparedness therefore cannot be determined by a single technology or by the existence of a certification.
How to measure your level of preparedness?
The first step is to carry out a review of the current situation.
A pre-audit compares what is in place against the applicable requirements and highlights:
- the measures already in place;
- the controls to strengthen;
- the priority gaps;
- the missing elements;
- the first actions to take.
This approach makes it possible to move from a general question — “Are we NIS2 compliant?” — to a concrete approach:
“What are our gaps and which actions should we prioritise?”
Free NIS2 pre-audit with Numeryx
Where do you really stand on NIS2?
Are you already ISO/IEC 27001 certified?
Do you have an ISMS but no certification yet?
Have you already put several cybersecurity measures in place?
Or are you starting from scratch?
Numeryx offers a free NIS2 pre-audit to help you establish an initial overview of your level of preparedness.
The pre-audit helps in particular to identify:
✓ Your current level of preparedness
✓ The main gaps against the applicable requirements
✓ The controls already covered by your set-up
✓ The areas requiring strengthening
✓ The first action priorities
Take stock of your situation
Answer a few questions to get an initial assessment of where you stand on NIS2.
A first diagnosis to know where you stand, identify your NIS2 gap and prepare the next steps.
