Preparing for NIS2 directive reporting obligations with ISO 27001
Perkola, Perttu (2024)
Julkaisun pysyvä osoite on
https://urn.fi/URN:NBN:fi:amk-2024112229342
https://urn.fi/URN:NBN:fi:amk-2024112229342
Tiivistelmä
NIS1 direktiivi astui voimaan vuonna 2016 parantaakseen Euroopan Unionin kyberturvallisuutta. Direktiivin koettiin onnistuneen tässä, mutta pian huomattiin, että se ei kuitenkaan ollut täysin riittävä tulevaisuudessa nousevia kyberturvallisuus uhkia varten. Uusi versio direktiivistä nimeltä NIS2 määriteltiin korvaamaan NIS1 direktiivi voimaantullessaan 18. lokakuuta 2024. NIS2 vaikutusalue laajenee koskemaan uusia toimialoja ja sektoreita, jonka myötä monien organisaatioiden täytyy valmistautua näihin kyseisiin vaatimuksiin kun ne on saatu sisällytettyä paikalliseen lainsäädäntöön. Uudet vaatimukset edellyttävät, että yritykset toteuttavat kyberturvallisuuden parantamista arvioimalla kyberturvallisuusriskejä ja kaikista merkittävistä kyberturvallisuus poikkeamista on ilmoitettava paikallisella valvovalle viranomaiselle. Ilmoitusvelvollisuus määritellään direktiivin artiklassa 23. Uudet raportointivelvoitteet merkittävienkyberturvallisuus poikkeamien yhteydessä edellyttävät, että organisaatiot tekevät ensimmäisen ilmoituksen viranomaiselle 24 tunnin sisällä poikkeaman havaitsemisesta ja lisäraportointia toteutetaan direktiivinmäärittelemillä aikarajoilla. Tämä edellyttää monia organisaatioita arvioimaan omia kyberturvallisuus käytäntöjä ja ottamaan käyttöön uusia kontrolleja tavoittaakseen direktiivin organisaatioilta edellyttämät minimivaatimukset. Monet organisaatiot valitsevat ratkaisuksi tähän kansainvälisen standardin, kuten ISO 27001, saavuttaakseen nämä minimivaatimukset.
The NIS1 directive was implemented in 2016 to bolster the cybersecurity resilience of the European Union, but even though it was successful on most parts it was soon deemed that it was not effective enough for current and emerging cybersecurity threats. A new version of the directive, called NIS2, was established that will replace the NIS1 directive and will become effective on the 18th of October 2024.
NIS2 requirements target many new sectors and subsectors, therefore many new organizations from the sectors are required to fulfill the requirements through new laws implemented in the local legislation of European Union countries. NIS2 implements requirements for companies in order to improve their cybersecurity resilience via risk management procedures and also required that any significant cybersecurity incidents are reported to official entities. The reporting obligations are outlined in Article 23 of the directive. The new reporting obligations related to cybersecurity incidents require that when encountering a significant cybersecurity incident, the organizations report it to the officials within 24 hours of discovering the incident and that more detailed reports are delivered later in a prefixed time window. This requires many organizations to have to assess the state of their cybersecurity practices and implement new controls in order to stay compliant with the directive’s minimum level of requirements, and many choose utilizing international standards, like ISO 27001, to achieve the required level.
The NIS1 directive was implemented in 2016 to bolster the cybersecurity resilience of the European Union, but even though it was successful on most parts it was soon deemed that it was not effective enough for current and emerging cybersecurity threats. A new version of the directive, called NIS2, was established that will replace the NIS1 directive and will become effective on the 18th of October 2024.
NIS2 requirements target many new sectors and subsectors, therefore many new organizations from the sectors are required to fulfill the requirements through new laws implemented in the local legislation of European Union countries. NIS2 implements requirements for companies in order to improve their cybersecurity resilience via risk management procedures and also required that any significant cybersecurity incidents are reported to official entities. The reporting obligations are outlined in Article 23 of the directive. The new reporting obligations related to cybersecurity incidents require that when encountering a significant cybersecurity incident, the organizations report it to the officials within 24 hours of discovering the incident and that more detailed reports are delivered later in a prefixed time window. This requires many organizations to have to assess the state of their cybersecurity practices and implement new controls in order to stay compliant with the directive’s minimum level of requirements, and many choose utilizing international standards, like ISO 27001, to achieve the required level.