A new European directive for network and information security should take digital security in the European Union (EU) to a higher level. For the chemical and manufacturing industries, the new directive includes a requirement to take 'appropriate cyber measures' from mid-2024. It also includes a duty to report cyber incidents.
EU member states as well as the European Parliament have agreed to a revision of the so-called EU Network and Information Security Directive (NIS2). The directive does not only affect the chemical and manufacturing industries. Other sectors including key players in the food sector (industrial food production and distribution such as larger supermarket chains), waste management, postal and courier services and data centres will also be affected by the directive.
Applicable to substantially more sectors
The renewed directive ensures that significantly more sectors will face mandatory measures and a reporting obligation. Under the current directive, this obligation has long applied to providers of essential services. Think banks, drinking water and energy companies. The same applies to digital parties, including providers of cloud services and online marketplaces. They have previously been designated by the central government to take measures for their digital security and report serious cyber incidents.
Compliance with this directive is also monitored in the Netherlands. The National Cyber Security Centre (NCSC), part of the Ministry of Justice and Security, provides assistance and advice to essential services. For digital service providers, these tasks are the responsibility of the Computer Security Incident Response Team (CSIRT DSP), part of the Ministry of the Interior and Kingdom Relations.
Essential and key providers
The revised version of the NIB2 directive now has two categories: essential providers and major providers. Essential providers are mainly parties operating in Dutch vital sectors. The supervision of these parties is proactive under the renewed directive.
With major providers, monitoring takes place precisely after the fact. If there are indications of an incident, surveillance is applied. Major providers are mainly (medium) sized parties where disruption does not have "very serious social or economic consequences".
Duty of Care
In addition to the reporting obligation, all providers covered by the revised directive must take security measures. This is also known as the 'duty of care'. Specifically, this includes increasing the security of their supply chain. Parties must also put in order the way they handle cyber incidents.
Minister Dilan Yeşilgöz-Zegerius (Justice and Security) points to the cross-border nature of cyber incidents. "We are increasingly dependent on digital processes, especially since corona we are increasingly working from home. We also see a growing digital threat from both criminals and state actors which, with a war on Europe's eastern border, is not going to abate for some time yet. It is therefore now necessary to take the next step to raise the level of cybersecurity in the EU. By doing so, we will prevent digital incidents from disrupting our society," the minister said.
'Impact could be huge'
Minister Micky Adriaansens (Economic Affairs and Climate): "We need to be alert to the risks of cyber attacks. The impact can be significant, such as empty shelves in shops or industrial production outages. Managing digital security remains an individual responsibility of companies and consumers. But with this legislation, we can take a step towards ensuring that the level of cyber security goes up among (medium-)large parties in more important sectors."
European Parliament is still voting on the directive. Following this vote, the NIB2 directive is expected to be published in autumn this year. EU member states can then transpose the directive into national law by mid-2024.
Author: Wouter Hoeffnagel
Photo: Pixabay / pixelcreatures
