Call us now:
Now the EU council has adopted EU NIS 2.0, what will it mean for EU National CNI providers, their suppliers, and ICT providers. There are a significant observations to be considered. Adopting cybersecurity risk management and holding management teams of covered organisations liable for cybersecurity risk management; to be suitably qualified to assess cyber risks; to implement cybersecurity in line with the risks identified; for member states and covered organisation to have appropriate governance structures in place; to evaluate and account for supply chain risk management of ‘direct’ suppliers.
The Cooperation group, EU and ENISA will identify critical ICT suppliers across the commission and may carry out coordinated security risk assessments of specific critical ICT services, systems or products supply chains. Cloud vendors beware Ted Dziekanowski. Covered entities will report an ‘early warning’ of an incident to the countries CSIRT within 24 hours and an incident notification within 72 hours. Country level CSIRTs will coordinate incident reporting and response with ENISA.
EU member states may require covered entities to use certified ICT products or services. The Commission can specifying which categories of essential or important entities shall be required to use certain certified ICT products, services and processes or obtain a certificate of cybersecurity compliance (Cyber resilience Act).
The scope of coverage is broad covering oil, gas, energy, chemicals, water, health, transport, banking, digital infrastructure, MSPs, public services and space. International firms be aware that both supply chain risk management and ICT requirements may have a direct impact.
#eunis2 #theaugustagroup #cybersecurity #cyberriskmanagement #cyberregulation #theaugustagroup
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3AugcPost%3A7004015106892169216