The NIS1 Directive was the EU's first cybersecurity law, which became the first horizontal internal market instrument aimed at improving the resilience of networks and information systems in the Union against cybersecurity risks. Following the challenges posed by the digitalization of organizations in the EU, which was accelerated in some cases by the Covid-19 pandemic, the Commission proposed a revised set of future-proof rules in December 2020 to strengthen the level of cyber-resilience in the Union, on which the co-legislators reached a political agreement on May 13, 2022, and formally adopted the new Directive at the end of November 2022. This new regulation came to be known as NIS2.
NIS2 · Directive (EU) 2022/2555
NIS2 Implementation
Information is one of the main assets of organizations, which is why it requires adequate protection systems against any threat that could jeopardize such information.
Phase 1, NIS2 Gap Analysis
Compliance status and action plan
Phase 2, NIS2 Implementation
Policies, measures and training
Phase 3, Internal Audit
Compliance verification
The board of directors
What is NIS2?
Applicability
Who does NIS2 affect?
Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union establishes a classification of the companies that must comply with the NIS2 Directive, focusing on what are termed essential and important entities.
The HIGH CRITICALITY sectors and subsectors are:
Energy
Electricity; District heating and cooling; Crude oil; Gas.
Transport
Air transport; Rail transport; Water transport; Road transport.
Banking
Financial market infrastructure
Healthcare sector
Water supply
Wastewater
Digital infrastructure
ICT business-to-business services management
Public administration
Excluding judiciary, parliaments and central banks.
Space
Applicability
Other critical sectors
And the OTHER CRITICAL SECTORS to develop the NIS2 directive are:
Postal and courier services
Waste management
Manufacturing, production and distribution of chemical substances and mixtures
Food production, processing and distribution
Research
Manufacturing
Manufacturing of medical devices and in vitro diagnostic medical devices; Manufacturing of computer, electronic and optical products; Manufacturing of electrical equipment; Manufacturing of machinery and equipment n.e.c.; Manufacturing of motor vehicles, trailers and semi-trailers.
Digital service providers
Providers of online marketplaces; Providers of online search engines; Providers of social networking services platforms.
Applicability
Also medium-sized companies
Additionally, it is highly relevant to bear in mind that NIS2 does not only affect large companies, but that, as defined by the directive, medium-sized enterprises in all these sectors must also be concerned by its implementation, given that the scope of application of
This Directive shall apply to public or private entities of any of the types referred to […] which are considered medium-sized enterprises in accordance with Article 2 of the Annex to Recommendation 2003/361/EC
this includes companies that employ fewer than 250 people and more than 50 people, whose annual turnover does not exceed 50 million euros or whose annual balance sheet does not exceed 43 million euros, and exceeds 10 million euros in either case.
Our services
How we work
The NIS2 regulation implementation project is being carried out in phases, where the relevant aspects necessary for each of them will be addressed.
01NIS2 Compliance Gap Analysis
Stage I: Gap Analysis Preparation
The schedule for the execution of the Gap Analysis is prepared, meetings will be convened, and the asset samples to be analyzed during the GAP will be selected. At the end of this stage, the start of the implementation project is formalized with the project sponsors and the relevant profiles for its execution.
Stage II: Gap Execution
An exhaustive analysis of the business is carried out to obtain the necessary knowledge by collecting information from personnel involved in compliance with the regulation, who are aware of the current policies, processes, and procedures that govern the entire organization and of the documentation that has been generated regarding compliance with the NIS2 Regulation or corporate documentation related to information security.
This stage also allows for the identification of relationships with third parties (service providers) and how they influence compliance with the NIS2 Regulation.
After understanding the compliance environment, the information obtained will be validated against the requirements established by the Regulation in order to check the Organization's compliance status.
Stage III: Gap Report and delivery of results
The results report is drafted, including the Action Plan with recommendations for full adaptation to the regulation.
The report will contain the following main points:
The schedule for the execution of the Gap Analysis is prepared, meetings will be convened, and the asset samples to be analyzed during the GAP will be selected. At the end of this stage, the start of the implementation project is formalized with the project sponsors and the relevant profiles for its execution.
Stage II: Gap Execution
An exhaustive analysis of the business is carried out to obtain the necessary knowledge by collecting information from personnel involved in compliance with the regulation, who are aware of the current policies, processes, and procedures that govern the entire organization and of the documentation that has been generated regarding compliance with the NIS2 Regulation or corporate documentation related to information security.
This stage also allows for the identification of relationships with third parties (service providers) and how they influence compliance with the NIS2 Regulation.
After understanding the compliance environment, the information obtained will be validated against the requirements established by the Regulation in order to check the Organization's compliance status.
Stage III: Gap Report and delivery of results
The results report is drafted, including the Action Plan with recommendations for full adaptation to the regulation.
The report will contain the following main points:
- Executive summary.
- Methodology used.
- Current compliance status.
- Action Plan.
02NIS2 implementation
Stage I: Task Planning
Based on the findings from the Gap analysis, the implementation tasks will be planned and executed. Responsibilities for each task will be assigned, and the project monitoring method will be established.
Stage II: Security Organization
Roles and responsibilities are defined to manage NIS2 Regulation requirements, such as: Information Security Managers, Information Security Committee(s), Information Owners, etc.
Stage III: Security Policy Definition
A Security Policy will be defined and must be approved by Management. This Policy will include information security objectives and will outline the commitments to comply with applicable security requirements and continuous improvement.
Stage IV: Measures for Compliance with Security Obligations
The execution and/or drafting of various activities and documentation must be taken into account, which will include, among others:
Training personnel is a key and necessary element, so a training plan must be defined in accordance with the characteristics and requirements.
Based on the findings from the Gap analysis, the implementation tasks will be planned and executed. Responsibilities for each task will be assigned, and the project monitoring method will be established.
Stage II: Security Organization
Roles and responsibilities are defined to manage NIS2 Regulation requirements, such as: Information Security Managers, Information Security Committee(s), Information Owners, etc.
Stage III: Security Policy Definition
A Security Policy will be defined and must be approved by Management. This Policy will include information security objectives and will outline the commitments to comply with applicable security requirements and continuous improvement.
Stage IV: Measures for Compliance with Security Obligations
The execution and/or drafting of various activities and documentation must be taken into account, which will include, among others:
- Risk Analysis
- Catalog of organizational, technological, and physical security measures
- Procurement of security products or services
- Incident Management
- Recovery plans and business continuity assurance
- Continuous improvement
- System interconnection
- User activity logs
Training personnel is a key and necessary element, so a training plan must be defined in accordance with the characteristics and requirements.
03Internal Audit
Stage I: Audit preparation
The Audit Plan will be prepared, determining points that may be necessary for certain tasks, time restrictions, the need to process access cards for rooms or buildings, points of contact, interview guides, etc.
Stage II: Audit execution
Meetings established in the Audit Plan from the previous phase will be held, carrying out a review of compliance with the NIS2 Regulation requirements.
Stage III: Audit report and delivery of results
As a result of the Audit, Internet Security Auditors will submit:
The Audit Plan will be prepared, determining points that may be necessary for certain tasks, time restrictions, the need to process access cards for rooms or buildings, points of contact, interview guides, etc.
Stage II: Audit execution
Meetings established in the Audit Plan from the previous phase will be held, carrying out a review of compliance with the NIS2 Regulation requirements.
Stage III: Audit report and delivery of results
As a result of the Audit, Internet Security Auditors will submit:
- Executive Summary.
- Audit Report.
- And an Action Plan.
Scope of service
What this service covers
Compliance Gap Analysis
Comprehensive assessment of the organization's current status regarding the requirements of the NIS2 Directive.
Security policy
Definition of the security policy approved by Management, including compliance objectives and commitments.
Organizational and technological measures
Catalog of organizational, technological, and physical security measures for compliance with obligations.
Incident management
Implementation of cybersecurity incident detection, notification, and response procedures.
Operational continuity
Recovery and business continuity plans for security incidents.
Cybersecurity training
Training and awareness plan adapted to the characteristics and requirements of the organization.
Internal audit
Compliance review with NIS2 Regulation requirements, including an audit report and action plan.
Testimonials
What our clients say
Working with Internet Security Auditors has been a highly satisfying experience. Their support throughout the migration to the ISO/IEC 27001:2022 standard, the execution of internal audits, and the PCI DSS certification process has been fundamental in strengthening our information security management system.
The strategic support of Internet Security Auditors as CISOaaS has been fundamental in strengthening our internal team. Their expertise perfectly complements our CISO's work and has allowed us to advance more quickly in our cybersecurity maturity.
On behalf of Outsourcing SAS BIC, we would like to express our gratitude for your commitment and dedication during the implementation of PCI DSS compliance in our call center. We succeeded in establishing a secure environment in accordance with the most demanding requirements of the payment industry.
Working with Internet Security Auditors has been a positive experience in every respect. Their team combines solid technical expertise with a great willingness for collaborative work, which has strengthened our security posture and regulatory compliance.
As CFO of Saint Louis University – Madrid Campus, I have had the opportunity to work with Internet Security Auditors. They have been our indispensable partner in implementing the requirements set forth by GDPR regulations. I would like to highlight their availability to resolve questions and their ability to develop a legal framework with concrete and understandable actions…
As the CFO of Fleurop - Interflora Spain, we have been working with Internet Security Auditors for years in the areas of consulting and GDPR compliance. As Interflora is a company 100% focused on e-commerce, the professional services of Internet Security Auditors provide us with support, security, and the peace of mind that all of our activity is aligned with GDPR compliance.
As CISO at Intaremit S.A., we place the utmost importance on logical security. This is not only due to the fact that PCI-CPP regulations require us to perform four internal and external vulnerability scans and an annual internal and external penetration test, but also because of the security and peace of mind our company aims to provide to each and every one of our clients. We have been working and collaborating with Internet Security Auditors for over 10 years due to their experience, commitment, and accessibility; therefore, I recommend them without hesitation.
At Grupo Arbulu, we have collaborated closely with Internet Security Auditors on the implementation of advanced cybersecurity measures. Thanks to their expertise, we have significantly improved our ability to detect and mitigate cyber risks. Their comprehensive audits and customized solutions have strengthened our security infrastructure, ensuring the protection of our data and the continuity of our operations.
As CEO of Beruby, we worked with Internet Security Auditors when we had to urgently perform a PCI DSS Attestation of Compliance. The entire process was extremely fast, efficient, and professional. Their team provided us with excellent support, demonstrating great technical knowledge and commitment. We undoubtedly recommend their services to any company in need of cybersecurity solutions.
At Grupo AR, we highly value the brand protection service provided by Internet Security Auditors for its comprehensive and proactive approach. Their highly qualified team allows us to identify and mitigate risks that could affect the AR Construcciones brand and its various companies.
Frequently Asked Questions
We answer your questions
What is the NIS2 Directive?
Directive (EU) 2022/2555, known as NIS2, is the evolution of the EU's first cybersecurity law. It establishes security, incident reporting, and governance obligations for essential and important entities in critical sectors, significantly expanding the scope of the original directive.
Which companies does NIS2 apply to?
NIS2 applies to medium and large enterprises (more than 50 employees and over €10M in turnover) in highly critical sectors (energy, transport, banking, health, water, digital infrastructure, public administration) and other critical sectors (postal services, waste management, food, manufacturing, digital services).
What are the main obligations of NIS2?
The main obligations include: implementing cybersecurity risk management measures, notifying competent authorities of significant incidents, ensuring supply chain security, conducting periodic risk assessments, and establishing management-approved cybersecurity governance policies.
What is the difference between essential and important entities?
Essential entities belong to high-criticality sectors (energy, transport, banking, health, water, digital infrastructure) and are subject to a stricter supervisory regime. Important entities belong to other critical sectors and have a reactive supervisory regime, but their security obligations are similar.
Can NIS2 be integrated with ISO 27001 or ENS?
Yes. NIS2 shares many requirements with ISO 27001 and the ENS. An organization that already has an ISMS compliant with ISO 27001 or that complies with the ENS can leverage a large part of the work already done. Internet Security Auditors has experience in the integration of these regulatory frameworks.
Contact
Do you need to implement the NIS2 Directive?
Tell us about your situation and our team will get in touch with you to provide guidance or schedule a technical call.
Request information
Global Presence
Our offices
Bogotá
Transversal 22 # 98-82, Porta 100 Building, Office 1003
110221 Bogotá (Colombia)
25
years of experience in cybersecurity
Contact us