Network security according to NIS2

The aim of the NIS guidelines is to equip system-relevant private and public sectors of the EU states with appropriate security technology and to improve the cooperative exchange of information on the subject of network security between the member states. NIS2 defines even clearer identification criteria for belonging to critical infrastructures according to the European Programme for Critical Infrastructure Protection (EPCIP) and includes new sectors:

All mid-size and large organizations operating in the sectors listed above, as well as companies that meet the specified criteria, will be covered by the new NIS2 directive.

As a result, a very large number of medium-sized enterprises are now obliged to observe the security measures laid down in the directive and are subject to certain reporting obligations.

The NIS2 directive addresses current cybersecurity threats by recognizing the impact of compromised or incapacitated organizations in a wider range of sectors, and makes these organizations accountable for a required level of information security. It also establishes a European information and network security communication and cooperation network, EU-CyCLONe.

The NIS2 directive primarily outlines national network security strategies and professional risk management. But what does that mean for you? And how can a network technology supplier like LANCOM help you?

First of all, each government of the EU member states has to lay down the legal framework in national law for their own country. By observing the following items, you will be well prepared for the national guidelines based on NIS2.

It's best to start now by reviewing and critically examining your current cybersecurity status. How sensitive and critical is the data you work with and are the services you provide? How serious would a system shutdown or outage be for your operations?

If you rate both of these highly, your network needs to be adequately protected. This starts with your technical equipment with secure, backdoor-free gateways and firewalls and leads on to good risk management.

Our security experts will be happy to advise you

The first task in effective risk management is to clearly define responsibilities: Who is in charge of protecting the network and to what extent – the in-house IT, a special security team, or an external service provider? What risks are relevant for you, and how do you protect yourself against them?

Clear regulations help to deal with security incidents and to keep operations running even in a crisis. Network security ranges from employee training, a secure supply chain, tested network components, systems, and services, and cyber hygiene procedures, over the use of encryption, access controls, and authentication, to secure voice, video, and text communications, and much more.

If something should go wrong despite all the precautions, damage limitation is ensured by emergency teams and procedures. Your network security emergency response team should be available at all times, have redundant communication channels, and be in a secure location.

Regular situation assessments and proactive vulnerability analysis help them to monitor your network around the clock, detect threats early, and inform you immediately in the event of a security incident.

After an IT security incident, every effort is made to recover from the crisis. But even before a crisis happens, what you need is a mature concept for data protection and digital sovereignty.

A major step has been taken once you have data backups and geo-redundant cloud servers. In the best case scenario, you will have in-house capabilities to close any security gaps and maintain the security of your systems.

While the prevention, resolution, and recovery from incidents is one thing, having the experts and resources to do so is another. NIS2 requires security precautions throughout the acquisition, development, maintenance, and management of networking and information systems. But not every company has the capacity for its own cybersecurity team.

In-house IT or experienced employees often have to manage network security and tasks such as firewall configurations in addition to their other duties. In cases like these, life can be a lot easier if you can rely on the right support.

Conclusion: The new EU NIS2 directive affects significantly more companies and institutions than its predecessor NIS1. It has more stringent specifications, a more clearly defined verification of their implementation, and stricter sanctions in case of non-compliance.

Especially industries in food processing, manufacturing, providers of public electronic network and communication services, and administrators of information and communication technologies need to check whether the new guidelines apply to them and to monitor how their country is implementing the EU's requirements into national law.

Ideally, you should get ready now and subject your network security to a critical check-up. LANCOM Systems can help you with this – with the right technical equipment, security solutions tailored to your needs, and the necessary know-how.