NIS2 two years later: Why compliance is only the baseline

Two years of NIS2: Progress and remaining challenges 

Only four of the 27 EU Member States met the NIS2 Directive's transposition deadline of 17 October 2024. Kudos to Belgium, Croatia, Italy, and Lithuania! 

Now, two years later, three countries have still not brought their national NIS2 legislation into force: France, Ireland, and Spain. 

This illustrates the challenges of implementing EU-wide legislation. And the delays are only part of the story. Differences in national implementations create additional complexity for multinational organizations, particularly regarding registration obligations, incident reporting procedures, and supervisory requirements. 

I've followed the development of NIS2 since it was still an early draft and have discussed its implications with many CISOs across different organizations. 

I believe that, at its core, NIS2 is good legislation. It genuinely pushes organizations and their leadership to take cybersecurity more seriously and improve their resilience. However, I've also heard frustrations about differing interpretations, the varying capabilities and approaches of competent authorities, and uncertainties surrounding some practical requirements. 

The illustration below shows some of the different layers of legislation, regulatory requirements, standards, and guidance that organizations need to consider, using Finland as an example. Understanding which ones apply can be challenging enough in one country, let alone across multiple countries. 

One security framework, multiple regulatory requirements 

From a CISO's perspective, it makes little sense to maintain separate security policies and guidelines for every country. Instead, organizations should aim for one common security framework that covers the applicable requirements, with local additions where necessary. 

This is also why NIS2 should not be treated as an organization's information security framework. Organizations should build their security management on internationally recognized standards and best practices, such as ISO/IEC 27001, the NIST Cybersecurity Framework, or the Information Security Forum's Standard of Good Practice for Information Security. 

The goal should be to go beyond NIS2 compliance. Mandatory legal requirements are a baseline, not the ultimate objective. Organizations also face numerous other regulatory, contractual, and sector-specific cybersecurity requirements. 

The challenge is to establish one coherent set of policies and controls that addresses them all. And ultimately, legal compliance alone does not make an organization secure or resilient. 

Good cybersecurity is no longer a competitive advantage. It is an expectation of customers and regulators. Poor cybersecurity, however, can be a significant competitive disadvantage. 

As an ICT service provider classified as an essential entity under NIS2, Vivicta faces these requirements directly. This gives us two perspectives: meeting our own obligations and understanding the requirements our customers face. Both underline the importance of consistent security practices and clear responsibilities between service providers and customers. 

Don't build cybersecurity on sand 

AI is making years, or even decades, of accumulated software vulnerabilities and system misconfigurations easier to discover and exploit. This makes basic cyber hygiene more important than ever. 

And I believe far too many organizations still have significant room for improvement in these fundamentals. 

Ensuring that well-established cybersecurity practices are followed is a tough but necessary task. At the same time, the secure and safe use of AI, digital sovereignty concerns, and increasingly demanding resilience requirements are adding even more to our plates. 

We cannot afford to build tomorrow's cybersecurity capabilities on weak foundations. 

NIS2 requirements, together with the available guidance and tools, provide a useful foundation for improving cybersecurity, even for organizations that are not legally required to comply with the directive. 

How can organizations demonstrate NIS2 compliance? 

There is no general EU-wide NIS2 compliance certification scheme. Various NIS2 maturity assessment tools and third-party audits can provide valuable insights into an organization's readiness and compliance gaps, but they cannot guarantee legal compliance. 

At least in Finland, competent authorities have already started conducting NIS2 compliance audits of essential entities. These audits provide an authoritative assessment of compliance, although even a successful audit does not guarantee ongoing compliance. 

The good news is that ISO/IEC 27001 certification provides an excellent foundation for NIS2 compliance. It demonstrates a systematic approach to managing information security, although additional measures may be needed to address specific legal obligations. 

My advice is to start with a common security framework, identify the applicable legal and customer requirements, and regularly assess how effectively your controls work. Don't create a separate security program for every new regulation. 

Ultimately, organizations should look beyond compliance and focus on the effectiveness of their security measures. 

Compliance is the baseline, not the ambition.