Navigating cybersecurity services in the era of NIS 2

The frequency of cyberattacks is increasing. What’s more, they are becoming more sophisticated, and the creativity of cybercriminals is making it challenging to ensure data and infrastructure security. In response, regulatory frameworks such as the NIS Directive have been introduced. Find out if your organization is obliged to implement the upcoming NIS 2 Directive recommendations and how Sii Poland’s expert services can help it in the process. 

In 2016, the European Union introduced standard network and information system security regulations. The dynamic digitization of many industries, as well as public services, required updated rules to address new challenges. 

How does the NIS2 Directive differ from previous regulations? 

The answer is the Network and Information Systems Directive 2 (NIS 2), introduced in 2023 and published by ENISA, the European Union Agency for Cybersecurity. It’s an updated version of the NIS 1 Directive, setting minimum security standards and requiring reporting of serious incidents to the Computer Security Incident Response Team (CSIRT) or national authorities. 

What are the changes introduced in NIS 2? 

• Rigorous standards for risk analysis, audit and incident handling, and cyber education. 
• Applicable to all EU countries. 
• Ensuring supply chain and business continuity. 
• Improve reporting obligations. 
• Strengthen the legal consequences for violating regulations. 
• Covering more sectors with regulation. 

One of the significant differences between NIS 1 and NIS 2 is the expansion of its scope. Until now, the existing directive covered two entities: operators of essential services (OES) and relevant digital service providers (RDSPs). NIS 2’s coverage now extends to more sectors, including transport, health, energy, finance, and public administration, and introduces a size criterion – medium and large companies must comply with the regulation. NIS 2 also applies to all companies, regardless of size, that have key value for specific sectors, the economy, or society. 

Entrust the security of your company’s data to experts 

The role of cybersecurity services providers who help organizations navigate the complex landscape of cyber threats and regulatory obligations is central to the effectiveness of these directives. 

— Our experience covers various aspects of cybersecurity at diverse organizations – from small companies to global enterprises — says Łukasz Sitkowski, Business Development Manager at Sii Poland. — We help companies implement cybersecurity risk management strategies by conducting expert audits, raising awareness of threats, developing security policies, and managing incidents — he explains. 

Sii Poland has built a cybersecurity expert team of more than 160 specialists, including experienced auditors and architects. They hold many certifications, such as OSCP, CEH, CISSP, GIAC GCIH, GIAC GCFE, and CompTIA Security+. Thanks to expert knowledge, the Cybersecurity Competency Center can provide organizations with comprehensive protection against the latest threats, which they execute through the Security Operations Center (SOC) unit, among others. With the help of modern cloud solutions, customers can take advantage of SOC-as-a-service offerings, adjusting the level and scope of protection to the company’s requirements by selecting 24/7 or 8/5 operation modes. 

How can Sii help your organization implement NIS 2? 

Sii offers a free Quick Assessment to determine if NIS 2 applies to your company and to specify the requirements you must meet to achieve compliance. 

For a comprehensive analysis, there is an Extended Assessment service, which checks the current security status and areas for improvement to meet regulatory requirements. Sii will then develop a prioritized, detailed plan tailored to your company’s needs and existing solutions and licenses. 

Sii will also provide full support during the implementation process, covering organizational and technical aspects to enable a smooth transition to NIS 2 compliance. In addition, Sii offers continuous operational support through dedicated Managed Services, such as Third Party Risk Management and SOC 24/7. 

Sii’s cybersecurity project for a US Fortune 500 company 

Sii has extensive experience enhancing cybersecurity within organizations, currently undertaking over 150 IT security projects. 

One example is a project conducted for an American Fortune 500 company providing financial services, including economic and investment planning, investment banking, and asset management. 

The organization needed to improve its SOC team’s efficiency and protect against growing cyber-attacks. By implementing 24/7 SOC support, Sii reduced the average time to resolve cybersecurity incidents by 50%. 

Improving the cybersecurity of Flying Tiger Copenhagen 

Sii experts also raised the level of internal security and provided support in identifying, implementing, and maintaining the security of Flying Tiger Copenhagen, a Danish chain of nearly 1 000 accessories stores worldwide. By conducting a security assessment of the company and IT environment and providing an 8/5 SOC service, the client gained continuous monitoring and incident resolution in accordance with the SLA, enabling the required level of cybersecurity. 

NIS 1 implementation at the Polish Air Navigation Services Agency 

What is more, Sii is an experienced partner in preparing large organizations for changing cybersecurity regulations. 

Sii Poland specialists implemented processes for the CSIRT team at PANSA. As a key service operator, the client was required to comply with the NIS 1 directive. Sii’s team analyzed the current security state, designed processes for incident handling and security monitoring, and created correlation rules for the SIEM system. 

— Data and system security is essential for any company, regardless of size — says Dawid Jankowski, Cybersecurity Competency Center Director at Sii Poland. — Customers expect the confidentiality of sensitive data, the leakage of which can lead to catastrophic consequences for both the company’s finances and reputation, resulting in loss of credibility, contracts, interruption of production, and even bankruptcy — he adds. 

NIS 2 will come into force on October 17, 2024. Contact Sii now to get a trusted and experienced partner who will handle all the details and guide your organization through the NIS 2 implementation process.