NIS2 Essential and Important Entities: BinariiLabs Insights

The European Union (EU) is taking asignificant leap forward in cybersecurity with the implementation of the NIS2Directive (Directive on measures for a high common level of cybersecurityacross the Union).  

This legislation aims tocreate a robust and unified approach to cybersecurity across all member states,fostering a high common level of protection for essential services. NIS2 willcome into effect from 17 October 2024. This article explains the Essential andImportant Entities and Sectors in scope for NIS2. A brief overview of NIS2 is:

1. Incident Notification: Responding Swiftly to Threats  

NIS2 mandates a tiered approach to incident notification. Essential and important entities must report incidents with"significant impact" on their services to the relevant national authority or CSIRT (Computer Security Incident Response Team) within adesignated timeframe. This will allow authorities to swiftly coordinate a response and minimize potential damage.

2. Enforcement & Penalties  

The directive empowers national authorities with a clear set of enforcement measures to ensure compliance. This includes the abilityto impose sanctions on companies that fail to meet their obligations.

3. Senior Management at the Helm: Taking Ownership ofCybersecurity

Perhaps most significantly, NIS2 places the ultimate responsibility for cybersecurity risk management on theshoulders of senior management in essential and important entities. This shift in accountability underscores the critical role leadershipplays in prioritizing and implementing effective cybersecurity measures.

By establishing a clear framework for cooperation and shared responsibility, NIS2represents a significant step towards a more secure digital future for theEuropean Union.  

Entities Designation: “Essential” or“Important”

Entities may be designated as“Essential” or “Important” depending on factors such as size, sector, and criticality. The main differentiation is that a disruption of services in the essential group would be expected to have serious consequences for the country’s society.  

Both entity groups must comply with the same security measures. However, those in the essential category are under proactive supervision, whereas those considered as important entities will only be monitored after an incident of non-compliance is reported. Organizations must take immediate steps to assess whether they fall within scope and whether they are considered an Essential or Important entity (KPMG, 2023). According to the reference guide by the National Cyber Security Centre, the classification isas follows (National Cyber Security Centre, Government of Ireland, n.d.):

Sectors in Scope  

NIS2 will apply to a wider and deeper pool of entities than currently covered by the NIS Directive. It includes new sectors while broadening the criteria for inclusion of entities, categorized as essential or important, within existing sectors. The sectors are divided into two groups:  

1. Sectors of High Criticality  2. Other CriticalSectors

This expanded scope ensures that more entities across various sectors are brought under a high common level of cybersecurity protection.  

How Binarii Labs Can Help with NIS2 Compliance  

Binarii Labs offers comprehensive solutions to ensure NIS2 compliance, enhancing your organization's cybersecurity posture and operational resilience:  

•       Complete Business Continuity: In the event of acloud location going down or being breached, your data remains 100% accessible with zero interruption.  

•       Mitigated Disaster Recovery Actions: With no downtime and continuous access to your data, even if a cloud location is downor breached, disaster recovery actions are minimal and involve little or no downtime.  

•       Reduced NIS2 Reporting: If one of your cloud locations is breached, there would be no "significant incident"requiring obligatory reporting. Instead, you may voluntarily report a threat occurrence with no data subject harmed.  

•       Proof of Record: Binarii Labs provides unique, independent blockchain-generated proof of the date, time, and provenance ofdata files. This proof can never be tampered with and is always reliable.

•       Automated Redundancy: Each data file is uniquely and individually duplicated on upload as part of the proprietary encryption, fragmentation, and multi-cloud distribution process, ensuring independent backups are happening live 24/7.  

•       Sovereign Ownership of Data: Benefit from an automated multi-cloud storage solution for each data file, choosing your owncloud providers. However, no single provider becomes the custodian of any complete data file.  

•       Ease of Use for Staff: No technical literacy is required by any staff member user, ensuring smooth operations.

•       Cost Effective: Binarii Labs offers a cost-effective SaaS billing model with no tech consultancy fees, providing afair and inexpensive pay-per-use model.  

By leveraging Binarii Labs' advanced solutions, organizations can confidently navigate the requirements of NIS2, ensuring compliance while maintaining robust security and operational efficiency. To learn more about how Binarii Labs' data security solutions can help your organization achieve compliance with NIS2, DORA, and GDPR regulations, visit our website at https://www.binariilabs.com/  

Bibliography  

1.       KPMG (2023) Network & Information Security Directive (NIS2) NIS2 (EU) DirectiveReadiness — May 2023 Levelling-up your IT and OT security capabilities in lightof the NIS2 , https://assets.kpmg.com/content/dam/kpmg/pl/pdf/2023/10/kpmgnetwork-and-information-security-directive-nis2.pdf.Available at:

https://assets.kpmg.com/content/dam/kpmg/pl/pdf/2023/10/kpmg-network-andinformation-security-directive-nis2.pdf (Accessed:01 August 2024).  

2.       National Cyber Security Centre andGovernment of Ireland (no date) NIS 2 A Quick Reference Guide. Department of the Environment, Climate and Communications, Governmentof Ireland. Available at:

https://www.ncsc.gov.ie/pdfs/NCSC_NIS2_Guide.pdf (Accessed: 01August 2024).  

‍