SANS recently conducted a survey on global organisations' awareness and preparedness for implementing measures as a result of the new EU regulation NIS2. Our newly released white paper not only highlights findings on organizational readiness and awareness, but also offers insights into modern threat capabilities and provides actionable recommendations for effective compliance strategies and training requirements. We also hosted a webinar on October 28th during which co-author Bojan Zdrnja took viewers through the report findings and SANS recommendations.
The NIS Directive, adopted in 2016, was the first EU-wide legislation on cybersecurity. Its main goal was to establish a common level of security for network and information systems across the European Union. The NIS2 Directive is an updated and more comprehensive version of the NIS Directive, aiming to address the shortcomings of the original legislation and to adapt to the evolving digital landscape. We’ve listed the most important differences between these two directives in a useful infographic.
| Industries & Entities considered essential | Industries & Entities considered important |
|---|---|
| Energy | Digital providers |
| Transport | Postal and courier services |
| Banking | Waste management |
| Financial market infrastructure | Food |
| Healthcare | Chemicals |
| Drinking water | Research |
| Digital infrastructure | Manufacturing |
| Managers of ICT services | |
| Wastewater | |
| Government services | |
| Aerospace |
Essential entities:
Important entities:
An organisation is large based on the following criteria:
An organisation is medium-sized based on the following criteria:
The European Cybersecurity Skills Framework (ECSF) is a practical tool to support the identification and articulation of tasks, competencies, skills and knowledge associated with the roles of European cybersecurity professionals. To enable you to see which skills are required for these roles and what courses and exercises might help you obtain these skills, we have created an easy-to-use mapping tool for you to discover your potential next training opportunity.
In this case study, explore how ISS, a global facility services provider, collaborates with SANS to enhance its cybersecurity capabilities across 28 countries. The video delves into the challenges of unifying diverse IT and security departments and highlights the critical role of ongoing training to adapt to rapid technological and criminal developments. Through firsthand accounts, learn about the implementation of the SANS maturity model, the strategic benefits of SANS training programs, and how ISS is leveraging this partnership to boost corporate resilience and attract top talent in cybersecurity. Discover the pivotal role of human factors in cybersecurity and how ISS is strengthening its defenses not just technologically, but also through skilled and certified personnel.
NIS2 is just one of many recent regulations that will have global repercussions. The recent US SEC ruling on Incident Reporting and Management oversight and the DOD 8140.3 ruling, all have implications for organisations and government instances on a global level.
SANS has a variety of other resources related to these recent regulatory changes which you can find here.
