NIS2: The EU directive with implications for Swiss cybersecurity

The most important requirements of NIS2

NIS2 introduces several important requirements that organizations must meet:

1. Expanded scope:
   NIS2 expands the scope of sectors and types of organizations that fall under its jurisdiction, including more public sector entities as well as critical infrastructure providers.
2. Risk management and incident reporting:
   Organizations must implement risk management measures that include risk analysis and security policies for information systems. Incidents with significant impact must be reported within 24 hours.
3. Supply chain security:
   There will be a greater focus on securing supply chains and organizations will need to ensure that their third-party vendors comply with appropriate cybersecurity standards.
4. Governance and accountability:
   Senior management must be involved in approving cybersecurity measures and can be held accountable for non-compliance. Regular audits and monitoring are required to ensure ongoing compliance.
5. Cooperation and information sharing:
   There is a call for increased cooperation between member states and better mechanisms for the cross-border exchange of information on threats and incidents.

Frequent difficulties in meeting the NIS2 requirements

Despite the clear objectives, organizations encounter various difficulties in adapting to NIS2:

1. Limited resources:
   Smaller organizations and public sector entities often struggle with limited budgets and human resources, making it difficult to implement comprehensive cybersecurity measures.
2. Complex compliance landscape:
   Navigating the complex and detailed requirements of NIS2 can be daunting. Companies must ensure that they interpret and apply the regulations correctly, which may require expert legal and technical advice.
3. Supply chain management:
   Ensuring that all third-party suppliers and partners in the supply chain adhere to the same security standards can be challenging, especially when dealing with a large number of suppliers.
4. Incident reporting and response:
   The requirement to report incidents within 24 hours can be difficult to fulfill, especially for companies that do not have advanced detection and response capabilities.
5. Harmonization issues:
   Different member states may implement and enforce the NIS2 provisions with some variations, creating an inconsistent compliance environment that can be difficult for multinational organizations to manage.

High-level plan for NIS2 implementation

The implementation of NIS2 requires a comprehensive approach that takes into account the technical , organizational and procedural aspects of cybersecurity. Swiss Post Cybersecurity recommends its customers to use a structured plan to fulfill the NIS2 requirements.

The following plan is a high-level overview and must be tailored to the specific needs and context of the organization implementing it. It is recommended to regularly engage with legal and cybersecurity experts to ensure a comprehensive and effective understanding of national law in relation to NIS2.

A) Preliminary assessment and planning

1. Applicability and scope of application
   Clarify whether your company or organization falls within the scope of NIS. While this article was written in summer 2024, most EU countries have not yet finalized their national NIS2 regulations, so there may still be some ambiguity about applicability and final requirements. Therefore, the following general plan should be adapted to the requirements of the jurisdiction or jurisdictions in which the organization operates, as well as to the needs of the organization itself.
2. Conduct a gap analysis
   Create an assessment of current cybersecurity measures against NIS2 requirements to identify gaps . Prioritize areas needing immediate attention based on risk assessments .
3. Develop a compliance roadmap
   Create a detailed action plan with timelines, responsibilities and resources required for compliance. Secure budget and management approval for the roadmap.
4. Set up a NIS2 compliance team
   Form a cross-functional team with representatives from IT, legal, risk management and senior management.

B) Risk management and policy development

1. Implementation of risk management measures
   Conduct regular risk assessments to identify potential threats and vulnerabilities. Developing and implementing risk management measures that include preventive, detective and corrective controls.

2. Updating information security policies
   Revise existing security policies to align with NIS2 requirements and ensure comprehensive coverage of all critical areas. Ensure policies address supply chain security, incident response and governance.

C) Technical and operational improvements

1. Strengthen incident detection and response
   Utilize advanced threat detection tools and technologies. Create a robust incident response plan with defined roles, responsibilities and processes .
2. Improvement of supply chain security
   Assess the cybersecurity posture of third-party vendors. Require suppliers to comply with cybersecurity standards and include appropriate clauses in contracts.
3. Introduce continuous monitoring and auditing
   Set up continuous security validation to detect and respond to threats in real time. Conduct regular audits and reviews to ensure continuous compliance with NIS2.

D) Training and awareness

1. Conduct phishing and awareness training for employees
   Develop and conduct regular awareness training for all employees. The focus is on the importance of cybersecurity, recognizing threats and complying with security guidelines.
2. Involvement of senior management
   Specific training for managers on their roles and responsibilities under NIS2. Ensure that management understands the strategic importance of cybersecurity and supports compliance efforts.

E) Reporting and documentation

1. Establish incident reporting mechanisms.
   Develop processes for internal and external incident reporting in line with NIS2 timelines.
   Ensure that incidents are reported within the 24 hour window required by NIS2.

2. Maintain complete documentation
   Thoroughly document all policies, procedures, risk assessments and incident reports. Ensure documentation is easily accessible for audits and regulatory reviews.

F) Collaboration and coordination

1. Promote internal collaboration
   Encourage collaboration between IT, Legal, Compliance and other departments to ensure consistent implementation. Hold regular meetings to review progress and address challenges.
2. Collaborate with external stakeholders
   Participate in industry forums and working groups to stay informed of best practices and regulatory updates. Establish communication channels with national and EU authorities to receive guidance and support.

Review and continuous improvement

1. Conduct regular reviews
   Schedule regular reviews to assess the effectiveness of the measures implemented. Update the compliance roadmap based on review findings and evolving threats.
2. Establish feedback loops
   Gather feedback from stakeholders on the measures implemented. Use the feedback to continuously improve policies, procedures and technical controls.