Blog NIS2: A Game-Changer in Global Cybersecurity for All Companies?
By Insight Editor / 25 Jun 2023 / Topics: Cybersecurity
By: Rob O'Connor, Technology Practice Lead at Insight
As someone who has fallen victim to a data breach, I stand firmly behind the European Union's ambitious move to raise the bar on global cybersecurity standards with NIS2. In an era dominated by Artificial Intelligence and growing digital interconnectivity, NIS2 is a beacon of hope in a sea of cyber threats. It not only strengthens our defences against data breaches but also sets a global precedent for safeguarding critical infrastructure and personal information.
The reality today is that we live in a digital age where our personal data is constantly at risk. Whether it's our financial information, healthcare records, or even the most mundane online interactions, our personal data is scattered across the vast digital landscape, often in the hands of large organizations. The European Union's General Data Protection Regulation (EU GDPR) provided some much-needed clarity on our rights concerning personal data. Still, once that data is compromised, the damage is done, and we, the victims, are left helpless.
The scale of the problem goes beyond individuals and corporations. Nation-states are now involved in cyberattacks on critical infrastructure, from power grids to agricultural supply chains. These attacks underscore the fact that security vulnerabilities are not just a localized concern; they are a global threat. Enter NIS2, the EU's ambitious initiative to establish minimum security requirements for medium and large critical organizations.
NIS2 is not just another piece of legislation; it's a proactive step towards enhancing global cyber resilience. It compels organizations to re-evaluate their risk management processes, establish robust incident response plans, enhance vulnerability management, and prioritize encryption and multi-factor authentication. This legislation, set to become law in EU member states next year, demands immediate attention, given the time required for assessment, strategy development, budget allocation, and implementation.
The predictions surrounding NIS2's impact are both significant and far-reaching. First, the scope of organizations falling under its purview is expected to expand over time, making it imperative for all organizations, irrespective of their status, to prepare.
NIS2 also has the potential to set a global standard. Many organizations, eager to streamline compliance efforts, may opt for a single, stringent baseline security standard across regions where they operate. Given the EU's vast market size, NIS2 is well-positioned to become the benchmark.
The demand for governance and risk management expertise will soar as organizations navigate the complexities of NIS2 compliance. Skills overlapping with ISO27001, an existing international standard for information security management, will be especially valuable for those looking to stay ahead of the curve.
One noteworthy feature of NIS2 is its provision for holding top-level executives personally liable in cases of severe negligence during a breach. This underscores that security is a responsibility at all levels of an organization, with accountability starting at the top.
NIS2 represents a pivotal step in addressing the pervasive issue of data breaches, often stemming from fundamental security lapses. As someone who has endured the fallout of identity theft, I see NIS2 as a clarion call to organizations still clinging to inadequate security practices. We are in the age of Artificial Intelligence, a realm filled with both promise and peril. While NIS2 may not directly address these emerging challenges, it sets a higher standard for organizations to mitigate preventable breaches.
My personal ordeal with identity theft pales in comparison to the potential catastrophic consequences of attacks on critical infrastructure. NIS2 offers a lifeline, a path toward improved security practices, similar to the trajectory we witnessed with GDPR.
The advent of NIS2 brings us closer to the level of security required to thrive safely in our interconnected, technology-dependent world. Legislators are often accused of lagging behind the white-hot pace of technology, but the private organisations we rely on—driven primarily by profit—often seem pedestrian with their security maturity, even by that low bar. NIS2 is about to raise the table stakes for organisations and that should be applauded.
The EU's new revision of the Network and Information Security Directive (NIS2) is coming, and it will revolutionise organisational cybersecurity like GDPR did to data privacy.
