Discover NIS2 requirements for OT

(Network and Information Security Directive) is an update of the European Union’s original NIS Directive, which aims to improve cybersecurity in EU member states. It focuses on broadening the scope and strengthening security requirements for various sectors, including operational technology (OT) systems. The following are the

Main requirements of NIS2 for OT:

1. Extension of the Scope of Application:

   o NIS2 for OT covers a larger number of critical sectors, such as healthcare, energy, transportation, water, digital infrastructure, and utilities and financial services, including smaller companies that were not covered by the original NIS Directive.

2. Risk Management and Safety Requirements:

   o Organizations should implement appropriate and proportionate measures to manage the risks that threaten the security of their networks and information systems.
   o These measures should include security policies, incident management, business continuity management, and the implementation of technical and organizational controls.

3. Notification of Incidents:

   o Organizations must notify the competent authorities of significant incidents affecting the security of their networks and information systems.
   o Deadlines for notification have been shortened, requiring an initial notification within 24 hours of detection of the incident.

4. Information Exchange and Cooperation:

   o Information exchange and cooperation between public and private entities, as well as between EU member states, is encouraged.
   o Organizations should participate in the exchange of information on cyber threats and vulnerabilities.

5. Supervision and Execution:

   o National authorities have greater powers to supervise and enforce compliance with NIS2 requirements for OT.
   o Stricter penalties are established for organizations that do not comply with the requirements of the directive.

6. Specific Requirements for OT:

   o Organizations that operate operational technology systems must implement additional measures due to the critical nature of these systems.
   o These measures include protection of industrial control systems (ICS), access management and network segmentation to reduce the risk of spreading cyber-attacks.

7. Continuous Risk Assessment:

   o Organizations are required to conduct ongoing risk assessments and update their security measures in light of new threats and vulnerabilities.

8. Training and Awareness:

   o Organizations must ensure that their personnel receive adequate and continuous training in cybersecurity and risk management.
   In summary, the NIS2 Directive establishes a more robust and detailed framework for improving cybersecurity in the EU, with a particular focus on protecting operational technology systems due to their critical importance to infrastructure and the economy.
   Organizations must prepare to meet these requirements by implementing more stringent security policies, improving their incident management capabilities, and actively collaborating with other entities to share threat intelligence.

Spain

In Spain, INCIBE has resources to monitor these NIS2 standards for OT. In this context and in the same way, leading manufacturers such as Cisco and Fortinet, these companies specialized in security technology have centers to prevent cyberthreats.