Nevertheless, according to recent cyber-attacks on critical infrastructure, the NIS directive was a much-needed initiative. Nobody can forget the WannaCry strike, that crippled the NHS in early 2017 and targeted various countries around the world.
The EU considers that network and systems are essential in today’s society. Therefore, they need to be protected against cyber threats. This is where the NIS directive comes to effect. It has a core purpose of achieving a high level of security of network and information systems within the EU. This directive brings new measures and requires all Member States to implement these.
Five new elements:
- The obligation is for the Member States to adopt a national strategy for cybersecurity;
- A cooperation group between the Member States;
- A Computer Security Incident Response Teams network (CSIRT), is efficient operational cooperation.
- The creation of security requirements for important digital service providers and services operators;
- The obligation for the Member States to designate competent national authorities, single points of contact and CSIRTs;
- In the UK, the NCSC will take on the formal roles of CSIRT and Single Point of Contact under the national framework.
Who does it apply to?
Two very different types of entities:
- Digital Service Providers (DSP) like online marketplaces, search engines, and cloud services;
- Operators of Essential Services (OES): energy, transport, banking, financial, health, drinking water supply and digital infrastructure; by 9 November 2018, Member States shall identify the OESs with an establishment on their territory;
Utilities in need of increased security (NIS directive)
In the UK, Margot James, Minister for Digital and the Creative Industries said: “We want our essential services and infrastructure to be primed and ready to tackle cyber-attacks and be resilient against major disruption to services.” One of the key elements of the NIS directive is to change behaviors when it comes to cyber-attacks on utilities. According to a report by EY, a very worrisome majority of utilities surveyed had very little cyber threat assessment measures in place. Given this statistic and the fact that a new cyber-attack is just around the corner, the NIS directive, although costly, can only seen as positive in the current climate.
Among other obligations, the NIS Directive imposes specific incident warnings and reporting obligations by OESs. They will no longer have the same freedom of reporting as before. Details of security breaches and other incidents will have to share with the competent National Authority under much stricter conditions.
What about costs?
Overall, sectors affected by the provisions of the NIS directive, from governments, DSPs and OESs should expect increased investment costs due to the implementation of the respective measures. Also, non-compliant organisations should also expect fines from the National Competent Authorities. Although penalties have left at the discretion of Member States, we may expect that the sums involved are comparable with those imposed by the General Data Protection Regulation (GDPR). For example, according to publicly available information, in the UK organisations risk fines of up to £17m.
Despite the expected financial impact of the NIS Directive, there seems to be a generally positive and hopeful attitude surrounding it, with stakeholders at all levels recognising the necessity and importance of the NIS directive in the digital age.
