In a landscape where cyber attacks are constantly evolving and becoming more sophisticated, companies can no longer rely on basic security measures. The Readiness Report 2024 highlights how only 20 percent of Italian business leaders feel prepared to deal with external threats. This security gap is particularly troubling in a context where Italy is at the bottom of the world rankings on cyber security preparedness. The European Union, aware of the vulnerability of critical infrastructures to increasingly sophisticated cyber threats, launched the NIS 2 (Network and Information Security) Directive with the aim of improving the digital resilience of strategic sectors. With the publication of Legislative Decree No. 138/2024, our country implemented the European NIS 2 Directive, which came into effect on Oct. 16, 2024. For companies operating in industrial areas, particularly those that manage critical or sensitive infrastructure, this legislation represents an important step in cybersecurity management.
What is NIS 2?
The NIS 2 Directive, approved in 2022 and intended to replace the previous NIS Directive of 2016, represents a significant step forward in critical infrastructure protection. This directive not only expands the number of sectors covered, but also imposes more stringent security requirements on companies. Key changes include:
- Expanded scope: NIS 2 includes more sectors considered critical to national and economic security, such as digital service providers, telecommunications, energy, healthcare and transportation. This means that many companies that were previously not subject to security requirements will now have to comply.
- Increased corporate responsibility: companies are required to implement more stringent security measures, with an increased focus on preventing, detecting and responding to cyber attacks. The directive also introduces obligations to report security breaches in a timely manner, thereby improving cooperation between national authorities and the companies involved.
- Tough penalties for noncompliance: NIS 2 provides for higher fines for noncompliance, similar to those introduced by the GDPR. This is intended to incentivize companies to take the protection of their networks seriously and implement the necessary defense systems.
The NIS Directive 2 was introduced to strengthen resilience and responsiveness to cyber incidents at the European level. The new legislation extends cyber security obligations to a broader range of sectors than its predecessor and introduces more stringent requirements for risk management, incident reporting, and direct involvement of business leaders. Essential and important enterprises, identified on the basis of their critical activities and services, will have to register on the National Cyber Security Agency’s (ACN) platform and implement technical and organizational measures for cyber security management.
Obligations and deadlines
NIS Directive 2 obliges companies to take a proactive and integrated approach to security. This translates into:
- Network segmentation: one of the best practices to mitigate risks is to segregate OT networks from IT networks. This way, even if a network is compromised, the potential damage is limited and malware cannot easily propagate from one part to another.
- Security by Design: NIS 2 encourages the adoption of security measures as early as the design phase of systems and networks. This approach aims to reduce vulnerabilities and ensure that new integrated technologies are secure from the start.
- Continuous monitoring and vulnerability management: companies must implement real-time monitoring systems that detect any abnormal activity in OT and IT networks. In addition, they must notify the relevant national authority of any significant incidents impacting services. In addition, vulnerability management becomes crucial: constantly updating systems with security patches and having an incident response plan are critical to ensure resilience.
Let us now give an overview of the obligations under NIS 2:
- Annual registration: companies must register on the ACN platform by February each year, providing detailed information on activities, services and key contacts.
- Information security policy: it is mandatory to develop a risk management strategy, including preventive measures, incident management procedures and supply chain protection.
- Ongoing training: a central aspect of the regulations is the requirement to ensure that staff are trained on an ongoing basis on cyber risks, promoting a corporate culture of security.
- Incident reporting: significant incidents must be reported within 24 hours of discovery, with a detailed update within 72 hours. “Near misses”-events that could have caused harm but were avoided-must also be reported.
Risks and benefits of NIS 2 for companies
Adapting to NIS 2 will require an investment in time and resources, but it will also bring significant benefits, including:
- Risk reduction: implementing advanced security measures reduces the likelihood of cyber attacks by protecting critical business infrastructure.
- Increased resilience: businesses that comply with regulations will see an improvement in their ability to respond to incidents, reducing downtime and limiting damage.
- Competitive advantage: being NIS 2 compliant sends a signal of trustworthiness to customers and partners, increasing brand trust and providing a competitive advantage over non-compliant.
An opportunity for growth
NIS 2 represents an opportunity for companies to strengthen their cyber defenses and ensure business continuity in an increasingly digitized environment. It is not just about complying with new obligations, but developing a security strategy that protects critical infrastructure and promotes greater resilience. Investing in advanced cyber security solutions is the key to meeting the challenges of the future and remaining competitive in an increasingly interconnected market.