The NIS1 Directive was the first EU cybersecurity law and became the first horizontal internal‑market instrument aimed at improving the resilience of networks and information systems in the Union against cybersecurity risks. Following the challenges posed by the accelerated digitalisation of organisations in the EU during the Covid‑19 pandemic, in December 2020 the Commission proposed a revised, future‑proof set of rules to strengthen the level of cyber‑resilience across the Union. The co‑legislators reached a political agreement on 13 May 2022 and formally adopted the new Directive at the end of November 2022. This new regulation became known as NIS2.”

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union establishes a classification of the companies that must comply with the NIS2 Directive, focusing on what are referred to as essential and important entities.

The sectors and subsectors of HIGH CRITICALITY are:

With the exception of the judiciary,
parliaments, and central banks

And the OTHER CRITICAL SECTORS to be developed under the NIS2 Directive are:

Additionally, it is very important to bear in mind that NIS2 does not only affect large companies; according to the Directive, medium‑sized companies in all these sectors must also be considered within its scope of implementation, given that the scope of application of…

This includes companies that employ fewer than 250 persons and more than 50 persons, whose annual turnover does not exceed 50 million euros or whose annual balance sheet total does not exceed 43 million euros, and exceeds 10 million euros in either case.

The implementation project for the NIS2 Regulation is carried out in phases, in which the relevant aspects required for each of them will be addressed.

A schedule is prepared for the execution of the Gap Analysis, meetings are convened, and the samples of assets to be analyzed during the Gap are selected.
At the end of this stage, the implementation project is formally initiated together with the project sponsors and the relevant profiles involved in its execution.

A thorough analysis of the business is carried out to obtain the necessary knowledge, gathering information from personnel involved in regulatory compliance who are familiar with the current policies, processes, and procedures governing the organization, as well as any documentation generated regarding NIS2 compliance or corporate information security documentation.

This stage also enables the identification of relationships with third parties (service providers) and how they influence compliance with the NIS2 Regulation.

Once the compliance environment is understood, the information obtained will be validated against the requirements established by the Regulation in order to assess the Organization’s compliance status.

A Results Report is drafted, including an Action Plan with recommendations for full alignment with the Regulation.

The report will contain the following main sections:

• Executive Summary
• Methodology Used
• Current Compliance Status
• Action Plan

Based on the findings identified in the Gap, the planning of the implementation tasks will be executed. Responsibilities will be assigned for each task, and the project monitoring method will be established.

Roles and responsibilities are defined to manage the requirements of the NIS2 Regulation, such as: Information Security Officers, Information Security Committees, Information Owners, etc.

A Security Policy will be defined and must be approved by Management. This Policy will include the information security objectives and will reflect the commitments to comply with applicable security requirements and to ensure continuous improvement.

The execution and/or drafting of various activities and documentation must be considered, including but not limited to:

• Risk Analysis
• Catalogue of organizational, technological, and physical Security Measures
• Acquisition of security products or services
• Incident Management
• Recovery plans and assurance of operational continuity
• Continuous improvement
• System interconnection
• User activity logging

Training personnel is essential, so a training plan must be defined according to the organization’s characteristics and requirements.

An Audit Plan will be developed, determining points that may be necessary for certain tasks, time restrictions, the need to process access cards to rooms or buildings, points of contact, interview guidelines, etc.

The meetings established in the Audit Plan from the previous phase will be carried out, conducting a review of conformity with the requirements of the NIS2 Regulation.

As a result of the Audit, Internet Security Auditors will deliver:

• Executive Summary.
• Audit Report.
• Action Plan.