NIS2 Directive: a boost for Cybersecurity in the European Union

NIS2 Directive: a boost for Cybersecurity in the European Union.

Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 (NIS 2 Directive) – currently in the process of transposition – on measures to ensure a high common level of Cybersecurity is a European Union regulatory milestone aimed at strengthening Cybersecurity and the protection of critical infrastructure and companies’ essential services against digital threats.

This recognition validates INCENTEA’s technical knowledge, vast experience and proven success in implementing cloud business management solutions, consolidating our status as a specialist partner in implementing Microsoft Dynamics 365 Business Central for small and medium-sized businesses.

INCENTEA already held recognized competencies in implementing Microsoft business applications, in both ERP and CRM solutions, and this new step reinforces our specialization in one of the most strategic areas for the digitalization of SMEs.

The specialization is centered on delivering Business Central as a reference ERP/CRM solution for small and medium-sized businesses, demonstrating our ability to provide effective, robust, fully cloud-oriented solutions.

Although combating cybercrime is one of the main focuses of NIS 2, the new directive extends to other risk scenarios, such as incidents arising from the negligence of companies and individuals, such as failures to implement adequate security measures, lack of maintenance of critical systems, human error or the absence of robust risk management practices, which can equally compromise the resilience and continuity of essential services.

Main Changes

In terms of the obligations for entities, the NIS2 Directive reinforces some of the measures already provided for in Decree-Law No. 65/2021 (NIS1), in an attempt to gain greater robustness in applying the measures, but also greater control, not only by companies but also by regulatory bodies:

• Strengthened Risk and Security Management – Entities must implement appropriate technical and organizational measures to manage Cybersecurity-related risks. This includes risk identification, risk measurement and the implementation of systems for protection, detection and response to threats and incidents.
• Incident Reporting – Incident reporting obligations have been strengthened, with clearer and shorter deadlines for reporting significant incidents to the competent authorities.
• Business continuity – Need to significantly strengthen the requirements for operational resilience, risk management and recovery capability of organizations in essential and important sectors. Business continuity becomes a required element.
• Top Management Responsibility – The board of directors or equivalent must be directly involved in overseeing compliance with Cybersecurity measures. Cybersecurity training for managers becomes mandatory.
• Cooperation with Competent Authorities – Strengthening of cooperation and communication mechanisms with national and European authorities to improve joint incident response.
• Stricter Penalties – Establishment of more severe penalties for entities that do not comply with the obligations imposed by the directive.

The Future of Cybersecurity in the European Union

The implementation of NIS2 reflects growing concern about the impacts of cyberattacks on an increasingly interconnected economy, with greater cross-border cooperation, harmonization of security standards and exchange of information between Member States.