The NIS2 Directive, adopted by the European Union, represents a significant advancement in cybersecurity regulations aimed at strengthening the resilience and response capabilities of member states. This directive builds upon the original Network and Information Systems (NIS) Directive, expanding its scope and introducing stricter security requirements for critical and important entities across various sectors. By promoting greater cooperation and information sharing among EU countries, the NIS2 Directive seeks to create a more unified and robust defense against the ever-evolving landscape of cyber threats.
As observed by ENISA in their annual report on the status of the cybersecurity threat landscape for 2023, the number of incidents has been steadily increasing, with the latter half of 2022 averaging out to about 111 incidents per month to 318 incidents per month in the first half of 2023, highlighting the urgent need for enhanced cybersecurity legislation. This rise in cybercrime underscores the importance of the NIS2 Directive.
Throughout the latter part of 2022 and the initial half of 2023, there was a notable escalation in cybersecurity attacks, setting new benchmarks in both the variety and number of incidents, as well as their consequences.
ENISA: Threat Landscape 2023The Directive entered into force on January 16, 2023, and EU member states have until October 17, 2024, to transpose the directive into their national laws. During this period, businesses and organisations must prepare to comply with the new requirements, ensuring that they meet the updated security standards and protocols set forth by NIS2.
The impact on your organisation:
The NIS2 Directive expands the scope of regulated entities by introducing new classifications: highly critical and other critical. Unlike NIS1, organisations under NIS2 will be categorised as either essential or important entities based on their societal importance. The directive imposes higher fines and management penalties, significantly pressuring organisations to enhance their cybersecurity measures. Over 150,000 organisations across the EU will be affected. In Cyprus, the impact is particularly significant, with ten times more organisations falling under the new directive compared to NIS1, which previously affected only 70 entities.
The cost of
non-compliance:
What happens if you fall short
Non-compliance with the NIS2 Directive can lead to significant consequences, including substantial financial penalties and operational disruptions. Fines for failing to meet the directive’s requirements can be severe, with penalties potentially reaching up to 2% of a company's annual global turnover or €10 million, whichever is higher.
Beyond financial repercussions, non-compliance may also result in reputational damage, increased scrutiny from regulatory bodies, and loss of trust from clients and partners. Organisations may face mandatory corrective measures, operational restrictions, or even legal action, which can impact business continuity and strategic objectives. It is crucial to take proactive steps towards compliance to avoid these risks and ensure robust protection against cyber threats.
Getting ready: steps to prepare your organisation for compliance
Preparing for compliance with the NIS2 Directive involves several key steps to ensure your organisation is aligned with the new regulations and fortified against cyber threats.
● Determine your compliance needs
● Understand the requirements
● Conduct a risk assessment
● Implement necessary security measures
● Test and evaluate
● Ensure supplier compliance
● Promote employee security awareness
Partner with PwC:
Expert guidance for NIS2
Navigating NIS2 compliance starts with determining your specific compliance needs. Understanding how it applies to your organisation with the right guidance is the first step toward building a strong cybersecurity framework.
Our team of experts provides tailored solutions in advisory and assurance services to guide you through every step of the compliance process. We help you adopt industry best practices, integrate advanced security measures, and stay ahead of emerging threats.
With our support, you can achieve NIS2 compliance efficiently, ensuring your organisation is not only meeting regulatory requirements but also enhancing its overall cybersecurity posture.
New Cybersecurity Regulatory Requirements
NIS2: Network and Information Security Directive 2
