Nevertheless, according to recent cyber-attacks on critical infrastructure, this directive was needed in the cybersecurity landscape. Nobody can forget WannaCry strike, that crippled the NHS in early 2017 and targetted in various countries around the world.
The EU considers that network and systems are essential in today’s society. Therefore, they need to be protected against cyber threats. This is where the NIS Directive comes to effect. It has a core purpose of achieving a high standard level of security of network and information systems within the EU. This directive brings new measures and requires all Member States to implement from May 10th this year.
Five new elements:
- The obligation is for the Member States to adopt a national strategy for cyber security;
- A Cooperation group between the Member States;
- A Computer Security Incident Response Teams network (CSIRT), is efficient operational cooperation.
- The creation of security requirements for important digital service providers and services operators;
- The obligation for the Member States to designate competent national authorities, single points of contact and CSIRTs;
In the UK, the NCSC will take on the formal roles of CSIRT and Single Point of Contact under the national framework.
Who does it Apply to?
Two very different types of entities:
- Digital Service Providers (DSP) like online marketplaces, search engines and cloud services;
- Operators of Essential Services (OES): energy, transport, banking, financial, health, drinking water supply and digital infrastructure; by 9 November 2018, Member States shall identify the OESs with an establishment on their territory;
Utilities in need of increased security
In the UK, Margot James, Minister for Digital and the Creative Industries, said: “We want our essential services and infrastructure to be primed and ready to tackle cyber attacks and be resilient against major disruption to services.” One of the key elements of the NIS Directive is to change behaviours when it comes to cyber-attacks on utilities. According to a report by EY, a very worrisome majority of utilities surveyed had very little cyber threat assessment measures in place. Given this statistic and the fact that a new cyber-attack may be just around the corner, the NIS Directive obligations, although costly, can only be seen as positive in the current climate.
Among other obligations, the NIS Directive imposes specific incident warnings and reporting obligations by OESs. They will no longer have the same freedom of reporting as before. Details of security breaches and other incidents will have to be shared with the competent National Authority under much stricter conditions.
What about costs?
Overall, actors affected by the provisions of the NIS Directive, from governments, DSPs and OESs should expect increased investment costs due to the implementation of the respective measures. Also, non-compliant organisations should also expect fines from the national Competent Authorities. Although penalties have been left at the discretion of Member States, we may expect that the sums involved are comparable with those imposed by the GDPR. For example, according to publicly available information, in the UK organisations risk fines of up to £17m.
Despite the expected financial impact of the NIS Directive, there seems to be a generally positive and hopeful attitude surrounding it, with stakeholders at all levels recognising the necessity and importance of the NIS Directive in a more and more digitised world.
Tags: thenis, to nis, nisd, ncsc gov uk, ncsc org uk, define nis, directive meaning, eu network and information security directive, information technology regulations, iso 27000 vs 27002, ISO 27001, iso 27001 and 27002 pdf, iso 27001 audit wiki, iso 27001 checklist download, iso 27001 checklist excel, iso 27001 checklist free, iso 27001 checklist pdf, iso 27001 checklist template, iso 27001 checklist uk, iso 27001 controls, iso 27001 controls checklist, iso 27001 controls excel, iso 27001 domain admins, iso 27001 domain areas, iso 27001 domains and controls pdf, iso 27001 password requirements, iso 27001 requirements checklist, iso 27001 requirements for logging and monitoring, iso 27001 requirements list, iso 27001 requirements pdf, iso 27001 version 2013 domains, iso 27001 wiki, iso 27001 wiki english, national cyber security strategy, national security network, network and information security directive, network information security directive, network information service, network of information, nis directive wiki, nis security, nis uk, office network security, security legislation, security s, what is nis