Adrian Johnson
TLDR:
Key Points:
- NIS2 directive is crucial for cyber resilience in the EU.
- Supply chain attacks are on the rise and pose a significant threat to organizations.
Decoding NIS2 to Secure Your Supply Chain
The NIS2 directive is a crucial framework for ensuring the cyber resilience of essential services and digital infrastructure across the European Union. While the directive does not apply directly to organizations in the UK, businesses may well be affected if they sell into the EU market, or members of their supply chain are required to comply. With just months until the October 17 directive deadline, concerned UK IT decision-makers must work closely with chief operating officers (COOs) and chief revenue officers (CROs) to ensure cybersecurity management is prioritized across their entire distribution chain to ensure NIS2 compliance and minimize the risk of security incidents that could wreak havoc on their operations, revenue and ability to scale.
There are several factors driving the rise in supply chain attacks. As organizations become more reliant on third-party suppliers, their attack surface grows larger and more complex. At the same time, adversaries are constantly seeking new ways to breach valuable businesses. Many of these third-party suppliers are viewed as softer targets that are easier to breach and can provide access to the larger organizations they work with – often without raising alarm. As enterprises have become better at hardening their environments, attackers view supply chain attacks as a creative means to operate undetected. Throughout 2023, targeted intrusion actors consistently attempted to exploit trusted relationships to gain initial access to organizations across multiple verticals and regions.
The NIS2 directive sets new risk management measures and reporting requirements for organizations, requiring them to implement a higher level of security across their network and information systems. The legislation applies to organizations based in EU member states that operate across 18 key economic sectors. It includes all organizations that employ more than 50 people or have a total annual turnover of more than €50m ($54.3m). The NIS2 provisions must be implemented before October 17, 2024. While not directly impacted by the directive, UK organizations are often intricately linked to EU partners within their supply chains. As a result, they may be affected by NIS2 in various ways.
While the NIS2 rules affect organizations classified as core infrastructure operating in the EU, UK businesses should follow in their footsteps to avoid being the weakest link in the chain of distribution. NIS2 is not only about compliance, it’s about inspiring all businesses to align themselves with the best cybersecurity standards possible. This is imperative for the cyber safety of supply chains, especially as more businesses move critical applications and data to the cloud.
