Update 2 October 2024: NIS2 directive officially “grounded” by the Italian government!
With the publication of the Official Journal of the Italian Republic on Tuesday 1 October, the “Transposition of Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972 and repealing Directive (EU) 2016/1148"....
For us it is a fundamental topic and we have been studying the directive for many months, do you want to know more? Talk to us about it, contact us.
October 18, 2024 is the fateful date of implementation of the European directive 2022/2555 (better known as NIS2). It is worth trying to delve deeper, thanks to the new information contained in a draft of the decree, preliminarily approved, into some points that were intentionally left at a high level in the original directive document.
Who will be involved?
One of the points where the greatest effort is being made is certainly the identification of the group of companies and organisations, public or private, subject to the new directive (what is defined as the scope of application).
The scope of the future decree should therefore include: highly critical and critical public and private entitiesas well as i related subsectors and types of entities that are subject to national jurisdiction (in fact, it must be remembered that one of the objectives of the directive is the harmonization of security policies between the various states also considering the realities that operate at a multinational level), as already indicated in the tables of the original directive (Tab.1 and Tab.2) . Furthermore, categories of public administrations and further types of subjects have been included, explained through some supplementary tables (not yet available at the moment).
From a dimensional point of view, the decree should apply to highly critical and critical subjects, who exceed 10 million euros of annual turnover (or total balance sheet) and employ più di 50 persone.
But also, regardless of their size:
- The subjects indicated by the European CER (Critical Entities Resilience) directive and its transposition decree;
- providers of public electronic communications networks or publicly accessible electronic communications services;
- trust service providers;
- top-level domain name registry operators and domain name system service providers;
- domain name registration service providers.
And also to some central, regional, local and other types of administrations.
Then other specific types of companies appear that are considered high risk for the public administration and ultimately for the State.
In short, we are talking about a truly large number of organizations, as some simulations suggest a number exceeding 15.000 subjects.
But how will all these companies and organizations actually know that they are subject to the NIS2 directive?
In practice, after the date of entry into force of the legislative decree, companies will have to register or update their registration on a digital platform made available by the competent national NIS Authority (i.e. the National Cybersecurity Agency - ACS).
Within the following year, the competent national NIS Authority will draw up the list of essential and important subjects, based on the registrations made. This "active" mechanism will make organizations compulsory a very preliminary, precautionary and aware approach to the regulation.
What will be the obligations imposed by the new NIS2 directive?
Two main obligations are outlined:
An obligation relating to the information systems security risk management measures to be undertaken.
The measures are intended to be based on a multi-risk approach (i.e. with an assessment that takes into consideration the overall set of risks, including those that may be linked), aimed at protecting information and network systems as well as their physical environment from incidents.
In practice, the objective will not simply be the protection of data and information but also the continuity of the business and, no less, the physical safety of people. From this perspective, it will be necessary to create an overall Cybersecurity management system which will certainly have to comply with the IEC 27000 and ISA/IEC 62443 standards therefore considering all the processes and systems of the company perimeter (IT and OT), without underestimating the aspects linked to the supply chain.
The measures must include at least the following elements:
- risk analysis and security policies for information and network systems;
- incident management, including procedures and tools to perform mandatory notifications (see next point)
- business continuity, including backup management, disaster recovery, where applicable, and crisis management;
- supply chain security, including security aspects concerning the relationships between each entity and its direct suppliers or service providers;
- security of acquisition, development and maintenance of information and network systems, including vulnerability management and disclosure;
- policies and procedures to evaluate the effectiveness of cybersecurity risk management measures;
- basic hygiene practices and cybersecurity training;
- policies and procedures relating to the use of cryptography and, where appropriate, encryption;
- safety and reliability of personnel, access control policies and management of assets and assets;
- use of multi-factor authentication or continuous authentication solutions, secure voice, video and text communications, and secure emergency communications systems by the individual in-house, where appropriate.
Once the risk management measures have been defined, the
Second obligation relating to the notification of cybersecurity incidents and information where necessary.
For notification purposes, interested parties are obliged to communicate to CSIRT Italy (always established within the National Cybersecurity Agency):
- without undue delay, and in any case within 24 hours of becoming aware of the significant incident, a pre-notification which, where possible, indicates whether the significant incident can be considered the result of illegitimate or malicious acts or can have a cross-border impact ;
- without undue delay, and in any case within 72 hours of becoming aware of the significant incident, an incident notification which, where possible, updates the information and indicates an initial assessment of the significant incident, including its severity and its impact, as well as, where available, indicators of compromise;
- at the request of CSIRT Italy, an interim report on relevant updates on the situation;
- a final report within one month of transmission of the accident notification, including:
- a detailed description of the incident, including its severity and impact;
- the type of threat or root cause that likely triggered the incident;
- the mitigation measures adopted and ongoing;
- where known, the cross-border impact of the incident;
- in case of an ongoing incident at the time of submission of the final report, a monthly progress report and a final report within one month of the conclusion of the incident management.
But who will carry out the inspections and how will they be carried out?
The competent national NIS Authority, in exercising its powers of verification and inspection with respect to the subjects falling within the scope of application of this decree, may subject the latter to:
a) checks of the documentation and information transmitted to the competent national NIS Authority pursuant to this decree;
(b) on-site and remote inspections, including random checks;
c) requests for access to data, documents and other information necessary to carry out the powers referred to in this article, declaring the purpose of the request and specifying the information requested from the subjects.
With respect to important subjects, the verification and inspection powers apply only if the competent national NIS Authority acquires or receives evidence, indications or information that suggest possible violations of this decree.
What are the risks?
Violations of the NIS2 directive may lead to sanctions:
- For essential entities, excluding public administrations, with administrative fines of up to a maximum of 10.000.000 euros or 2% of the total annual turnover on a global scale for the entity's previous financial year
- For major entities, excluding public administrations, with administrative fines of up to a maximum of 7.000.000 euros or 1,4% of the total annual turnover on a global scale for the entity's previous financial year
- For public administrations with administrative fines ranging from €25.000 to €125.000.
Also read our blog articles on this topic: