Nevertheless, taking into account some very recent cyber-attacks on critical infrastructure, this directive has been long needed in the cyber security landscape. Who can forget the WannaCry strike, that crippled the NHS in early 2017 and hit a number of other targets in various countries around the world?
The EU recognized that network and information systems are an essential part of living in today’s society and, therefore, they need to be safeguarded against any threats against them.
This is where the NIS Directive comes to play. Its purpose is to achieve a high common level of security of network and information systems within the EU. To this end, this directive brings a heap of new measures implemented by all Member States starting with May 10th this year.
5 new elements:
• The obligation for Member States to adopt a national strategy for cyber security;The obligation for Member States to adopt a national strategy for cyber security;
• A Cooperation group between Member States;• A CSIRT’s network (“computer security incident response teams network”) for the purpose of swift and effective operational cooperation;
• The creation of security and notification requirements for operators of essential services and for digital service providers;
• The obligation for Member States to designate national competent authorities, single points of contact and CSIRTs;
In the UK, the NCSC will be taking on the formal roles of CSIRT and Single Point of Contact within the national framework.
Who does it apply to?
Two very different types of entities:
1. Digital Service Providers (DSP) like online market places, search engines and cloud services;
2. Operators of Essential Services (OES): energy, transport, banking, financial, health, drinking water supply and digital infrastructure; by 9 November 2018, Member States shall identify the OESs with an establishment on their territory;
Utilities in need of increased security
In the UK, Margot James, Minister for Digital and the Creative Industries, said: “We want our essential services and infrastructure to be primed and ready to tackle cyber attacks and be resilient against major disruption to services.”
One of the key elements of the NIS Directive is to change behaviours when it comes to cyber-attacks on utilities.
According to a report by EY, a very worrisome majority of utilities surveyed had very little cyber threat assessment measures in place. Given this statistic and the fact that a new cyber-attack may be just around the corner, the NIS Directive obligations, although costly, can only be seen as positive in the current climate.
Among other obligations, the NIS Directive imposes specific incident warnings and reporting obligations by OESs. They will no longer have the same freedom of reporting as before. Details of security breaches and other incidents will have to be shared to the competent National Authority under much stricter conditions.
What about costs?
Overall, actors affected by the provisions of the NIS Directive, from governments, DSPs and OESs should expect increased investment costs due to the implementation of the respective measures.
In addition, non-compliant organizations should also expect fines from the national Competent Authorities. Although, penalties have been left at the discretion of Member States, we may expect that the sums involved are comparable with those imposed by the GDPR. For example, according to publicly available information, in the UK organizations risk fines of up to £17m.
Despite the expected financial impact of the NIS Directive, there seems to be a general positive and hopeful attitude surrounding it, with stakeholders at all levels recognising the necessity and importance of the NIS Directive in a more and more digitised world.