For those focused on the SEC final rule, spare a thought for those European (and US) firms covered by EU NIS 2.

← Back to Blog

For those focused on the SEC final rule, spare a thought for those European (and US) firms covered by EU NIS 2. That along with DORA were added to the EU Journal in January 2023, to be transposed by EU partner nations by Q4 2024. Dwarfing the SEC ruling, why?

Management bodies of essential and important CNI entities are to oversight and approve the measures taken to manage cyber risks and risk management policies. The SEC rule removed the requirement to document and report policies.

EU NIS 2 requires covered CNI providers to raise an early warning incident report of a significant cyber event within 24 hours. The Significance bar is set well below the material bar set by the SEC final rule.

The members of the management bodies of essential and important entities are required to follow training and train their employees on a regular basis.

NIS 2 introduces comprehensive risk-based ex-ante and ex-post supervision; targeted security audits by the national authority; civil and potentially criminal penalties; fines against entities and persons; the temporary suspension of natural persons responsible for failing to discharge their managerial responsibilities.

The scope of NIS 2 has the potential to be huge, as the enclosed update from the 14th September outlines. EU Member states have to establish a list of essential and important CNI entities using Annex I and II of the Directive (Article 3). As the enclosed demonstrates the list of potential entities covered by EU NIS 2 will be in the 10s thousands. Documented by EU Member state.

One should remember that covered entities include those covered by the SEC Final rule; entities whose parent organization’s are located outside the EU and/ or organizations owned outside the EU. Placing management oversight and assurance under the jurisdiction of the EU NIS 2. One also wonders the effect on cyber and D&O insurance?

Ted Dziekanowski Olaf Classen

#cybersecurity #cyberriskmanagement #eunis2 #cyberregulation

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7109114057013485568