Discover NIS2 requirements for OT
Discover NIS2 requirements for OT
(Network and Information Security Directive) is an update of the European Union’s original NIS Directive, which aims to improve cybersecurity in EU member states. It focuses on broadening the scope and strengthening security requirements for various sectors, including operational technology (OT) systems. The following are the
Main requirements of NIS2 for OT:
-
Extension of the Scope of Application:
o NIS2 for OT covers a larger number of critical sectors, such as healthcare, energy, transportation, water, digital infrastructure, and utilities and financial services, including smaller companies that were not covered by the original NIS Directive.
-
Risk Management and Safety Requirements:
o Organizations should implement appropriate and proportionate measures to manage the risks that threaten the security of their networks and information systems.
o These measures should include security policies, incident management, business continuity management, and the implementation of technical and organizational controls. -
Notification of Incidents:
o Organizations must notify the competent authorities of significant incidents affecting the security of their networks and information systems.
o Deadlines for notification have been shortened, requiring an initial notification within 24 hours of detection of the incident. -
Information Exchange and Cooperation:
o The exchange of information and cooperation between public and private entities, as well as between EU member states, is encouraged.
o Organizations should participate in the exchange of information on cyber threats and vulnerabilities. -
Supervision and Execution:
o National authorities have increased powers to monitor and enforce the requirements of the NIS2 for OT.
o Stricter penalties are established for organizations that do not comply with the requirements of the directive. -
Specific Requirements for OT:
o Organizations that operate operational technology systems must implement additional measures due to the critical nature of these systems.
o These measures include the protection of industrial control systems (ICS), access management and network segmentation to reduce the risk of cyber-attacks spreading. -
Continuous Risk Assessment:
o Organizations are required to conduct ongoing risk assessments and update their security measures in light of new threats and vulnerabilities.
-
Training and Awareness:
o Organizations should ensure that their personnel receive adequate and continuous training in cybersecurity and risk management.
In summary, the NIS2 Directive establishes a more robust and detailed framework for improving cybersecurity in the EU, with a particular focus on protecting operational technology systems due to their critical importance to infrastructure and the economy. Organizations must prepare to meet these requirements by implementing more stringent security policies, improving their incident management capabilities, and actively collaborating with other entities to share threat intelligence.
Spain
In Spain, INCIBE has resources to monitor these NIS2 standards for OT. In this context and in the same way, leading manufacturers such as Cisco and Fortinet, these companies specialized in security technology have centers to prevent cyberthreats.
