NIS-2 is coming: We will make your company compliant for IT security

FAQ on the NIS-2-Compliance

• What is the NIS-2 directive?

  The NIS 2 Directive extends the security requirements for a large number of companies. Affected companies must introduce enhanced cyber security measures, such as risk management, BCM and reporting obligations in the event of security incidents. A regular review of security processes is also prescribed. Non-compliance can lead to high penalties.

• How does NIS-2 affect my company's IT security strategy?

  NIS-2 forces companies to rethink their IT security strategy and align it with new requirements. More comprehensive measures are needed to minimize risks, including better monitoring and reporting of incidents. The directive also encourages the introduction of emergency plans and security audits. Companies must therefore invest more in IT security.

• What role does management play in the implementation of NIS-2?

  Management is responsible for implementing the NIS 2 directive. Appropriate security precautions must be taken to prepare the company for potential cyber attacks. Regular training for employees and management is also required. A lack of management commitment can lead to legal consequences.

• How does NIS-2 affect cooperation with partners and suppliers?

  Under the NIS 2 Directive, companies are obliged to check the security standards of their partners and suppliers. A weak security infrastructure of a business partner can pose considerable risks for the company itself. Partner networks must therefore also comply with stricter cyber security measures. This often requires new contracts and closer monitoring of supply chains.

• What do I have to do if I already have an ISMS to establish NIS-2 compliance?

  If your company has already implemented an information security management system (ISMS), you have already implemented a large part of the NIS-2 requirements. The NIS-2 requirements extend an ISMS according to ISO27001 in some areas, such as: Reporting obligation, registration obligation, etc.). These specifics must be integrated into the ISMS. You should therefore carry out a compliance check with the NIS-2 requirements.

• What specific details have to be taken into account in Germany?

  In Germany, there are a number of technical standards and certifications that can help companies meet the requirements of the NIS 2 Directive. Examples include ISO 27001 certification for information security management systems and the BSI IT Grundschutz Compendium of the Federal Office for Information Security.

  Companies that are already subject to the BSI Critical Infrastructure (KRITIS) Regulation or the Security Act 2.0 of the Federal Office for Information Security have already established a high level of security in the past. Nevertheless, it is also advisable here to use a gap analysis to identify possible gaps for NIS 2.

  A successor for the implementation of the NIS 2 Directive is still open, but this should be in place by October 2024 at the latest.

• How will NIS-2 be applied in Austria?

  In Austria, the previous EU NIS Directive was implemented through the Austrian NIS Ordinance (BGBl. II No. 215/2019) and the Austrian NIS Act (BGBl. I No. 111/2018). A successor for the NIS 2 Directive is still open, possibly the NIS Act will be amended for the new requirements.

  In Austria, there are a number of technical standards and certifications that can help companies meet the requirements of the NIS 2 Directive. Examples include the ISO 27001 certification for information security management systems and the Austrian Information Security Handbook.

• What specific details apply in Switzerland?

  Switzerland is not a member of the European Union and is therefore not directly bound by the NIS 2 Directive. However, Switzerland has similar cyber security provisions, and the requirements for critical infrastructure operators and service providers are similar to those specified in the NIS-2 Directive.

  In Switzerland, the National Cyber Security Center (NCSC) is responsible for coordinating and implementing cyber security measures. The NCSC works closely with critical infrastructure operators and other relevant partners to ensure the security of the Swiss cyberspace.

• When should I get involved in NIS-2?

  As a company or organization, you should address the NIS 2 Directive as early as possible, especially if you are a critical infrastructure operator or digital service provider.

  If the NIS 2 Directive applies to you, you must take appropriate action promptly once your industry is brought within the scope of the NIS 2 Directive to avoid large penalties.

  Even if your company is not directly affected by the NIS 2 Directive, it can still benefit from the regulations by improving its cyber security measures and better protecting itself against cyber attacks. We can help you take appropriate measures to improve your cyber security and make your business processes more secure.