NetAlly's CyberScope addresses multiple NIS2 directive measures

Organizations across the European Union (EU) face escalating IT threats, from physical disruptions to cyberattacks. Though all aspects of IT are at heightened exposure, one area of significant challenges is the network perimeter. Why? The network edge is frequently ground-zero for many hackers because it offers so many attack vectors:

• Proliferation of endpoints
• Increased attack surfaces
• Ubiquitous connectivity
• Undetected vulnerabilities
• Unsecured connections
• Misconfigured networks

The edge network is where NetAlly’s CyberScope and Link-Live™ cloud-based collaboration, sharing, and analysis platform can aid EU entities in strengthening their cybersecurity posture and addressing NIS2 Directive measures.

What is the NIS2 directive?
NIS2 stands for “Network and Information Security Directive”. Here is the official definition*:
The NIS2 Directive (Directive (EU) 2022/2555) is a legislative framework designed to enhance cybersecurity across the European Union by establishing a high common level of security for network and information systems. It builds upon the original NIS Directive, expanding its scope and strengthening requirements to better address evolving cyber threats.

Under NIS2, essential and important entities must adopt appropriate, proportionate technical, operational, and organizational measures to manage
cybersecurity risks. These measures aim to protect network and information systems, as well as to prevent or minimize the impact of incidents on service
recipients and interconnected services.

The directive mandates an “all-hazards” approach, meaning that entities must be prepared to address a wide range of threats, from cyberattacks to
physical disruptions, ensuring comprehensive protection and resilience in their operations.

Summarizing, the objective of NIS2 is to manage risk and strengthen the security of network and information systems for organizations within the EU
by bolstering the cybersecurity resiliency of their critical infrastructure and essential services. The directive includes minimal obligations of entities that
must be carried out to protect against cyber threats, and should a breach occur, incident reporting guidelines to relevant authorities.

The NIS2 directive is now law
New rules to boost cybersecurity of EU’s critical entities and networks** are now in effect.
“…Today’s adoption of the implementing regulation coincides with the deadline for Member States to transpose the NIS2 Directive into national law. As of 18 October 2024, all Member States must apply the measures necessary to comply with the NIS2 cybersecurity rules, including supervisory and enforcement measures.”

Once enforcement begins, EU entities within the member states required to comply must demonstrate compliance with the NIS2 directive measures. Therefore, it is incumbent these entities begin implementation efforts quickly. These entities fall into two broad categories, those that provide “essential” or “important” services to the European economy or society. Essential organizations include Transport, Energy, Banking, Health, and Water, while important entities span: Postal and courier services, Waste management, Chemical production and processing, Food, and Digital providers

NIS2 Cybersecurity measures minimal obligations
The NIS2 Directive Article 21***, Cybersecurity risk-management measures shall include at least the following (see the appendix for more details):

(a) policies on risk analysis and information system security

(b) incident handling

(c) business continuity, such as backup management and disaster recovery, and crisis management

(d) supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers

(e) security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure

(f) policies and procedures to assess the effectiveness of cybersecurity riskmanagement measures

(g) basic cyber hygiene practices and cybersecurity training

(h) policies and procedures regarding the use of cryptography and, where appropriate, encryption

(i) human resources security, access control policies and asset management

( j) the use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate

How CyberScope addresses specific NIS2 measures
CyberScope offers two key advantages to addressing NIS2 measures:

• The handheld form factor. By connecting directly to any perimeter physical port or wireless access point, this “see the edge from the edge” perspective provides a much more comprehensive view of potential cybersecurity vulnerabilities. Compared with centralized cybersecurity solutions, this makes it uniquely positioned to address several NIS2 measures at the network edge.
• The many capabilities associated with the CyberScope Cybersecurity Assessment Workflow (described below) can be efficiently implemented in a straightforward process that can subsequently serve as input into more extensive enterprise audits and compliance efforts.

Because of its distinct design, form factor, and capabilities, CyberScope, in conjunction with Link-Live, can aid your larger NIS2 compliance initiatives, mapping to key aspects of NIS2’s minimal obligations. In the process, CyberScope greatly strengthens your organizations security posture while increasing overall situational awareness at the network perimeter.

Want to learn more?

Replay the webinar on this subject from 19.februari 2025

• Share: