توجيه NIS2, which entered into force on January 16, 2023, is the European Union’s response to increasingly sophisticated cyber threats and the overall changes in the digital world. It marks a pivotal step towards strengthening and harmonising cybersecurity standards across EU member states, aiming to enhance resilience and safeguard critical sectors against emerging digital risks.

تستكشف هذه المقالة الأهداف الرئيسية والتأثيرات الخاصة بكل قطاع لتوجيه NIS2، مع تسليط الضوء على تداعياته على عملك.

ما هو توجيه NIS2؟

توجيه NIS2 (توجيه الشبكات وأنظمة المعلومات 2) هو إطار تنظيمي أنشأه الاتحاد الأوروبي لتعزيز وتوحيد الأمن السيبراني عبر الدول الأعضاء.

على من ينطبق توجيه NIS2؟

Building upon the original NIS Directive, NIS2 aims to improve the overall security and resilience of network and information systems critical to the functioning of society and the economy. This includes sectors such as:

مقدمو الخدمات الأساسية:

  • الطاقة
  • النقل
  • الخدمات المصرفية
  • البنى التحتية للأسواق المالية
  • قطاع الصحة
  • إمداد وتوزيع مياه الشرب
  • البنية التحتية الرقمية

مقدمو الخدمات الرقمية:

  • الأسواق الإلكترونية
  • محركات البحث الإلكترونية
  • خدمات الحوسبة السحابية
  • الإدارة العامة:
  • الجهات الحكومية المركزية
  • الكيانات الحكومية الإقليمية والمحلية التي تُعدّ أمنها السيبراني أمرًا بالغ الأهمية للأمن القومي

مزودون من خارج الاتحاد الأوروبي:

على الرغم من أن التوجيه ينطبق فقط على الكيانات داخل الاتحاد الأوروبي، إلا أنه يفرض أيضًا على المزودين من خارج الاتحاد الأوروبي إنشاء كيان قانوني داخل الاتحاد الأوروبي.

ما الأهداف الرئيسية لتوجيه NIS2؟

Organisations across various sectors need to comply with the Directive by implementing the required cybersecurity measures and ensuring ongoing adherence to the established standards. Non-compliance can result in significant legal and financial consequences, making it crucial for organisations to invest in their cybersecurity infrastructure and practices. Here are some key objectives of NIS2:

تدابير أمن سيبراني معززة

NIS2 mandates more rigorous risk management practices, ensuring organisations implement robust cybersecurity measures and conduct regular risk assessments. One typical method of assessment is Threat and Risk Analysis (TARA) or Threat Modelling Analysis. These involve evaluating the criticality of specific assets that comprise our service or product and identifying which types of cyber threats could be critical in this context.

الإبلاغ المعزز عن الحوادث

NIS2 requires organisations to report significant cybersecurity incidents promptly to relevant authorities and inform affected individuals. This aspect involves enhancing cooperation and information exchange by specifying the necessary elements to report, as well as types of incidents and threats.

نطاق أوسع

As already mentioned, the NIS2 Directive extends its reach to more sectors and entities, including healthcare, transport, energy, banking, digital infrastructure, and more, ensuring comprehensive coverage.

تعاون محسّن

يعزز تعاوناً أفضل وتبادلاً للمعلومات بين الدول الأعضاء في الاتحاد الأوروبي، مما يعزز استجابة منسقة للتهديدات السيبرانية العابرة للحدود.

Since the release of NIS in 2016, the IT landscape has undergone significant changes with the emergence of new technologies and threats. Harmonising and updating regulations across all EU member states became necessary to adapt to these developments.

مساءلة معززة

NIS2 raises penalties for violations and introduces personal accountability of cybersecurity leaders within an organisation. If the organisation fails to appoint a designated individual for this role, the responsibility falls on the company’s management. According to NIS2, if an organisation classified as critical is successfully attacked by cybercriminals, the company’s management will be held criminally liable. This approach aims to enforce a more rigorous approach to cybersecurity.

NIS2 Directive

ما هي متطلبات NIS2؟

باختصار، تشمل متطلبات التوجيه الجديد:

إدارة المخاطر

اعتماد نهج قائم على المخاطر لإدارة تهديدات الأمن السيبراني بفعالية.

الاستجابة للحوادث

تطوير وصيانة خطط الاستجابة للحوادث لمعالجة تأثير الحوادث السيبرانية والتخفيف منه بسرعة.

المراقبة المستمرة

المراقبة والتدقيق المنتظم لممارسات الأمن السيبراني لضمان الامتثال وتحديد مجالات التحسين.

التدريب والتوعية

ضمان تدريب الموظفين بشكل كافٍ على أفضل ممارسات الأمن السيبراني وإدراكهم لأحدث التهديدات والثغرات الأمنية.

التدابير التقنية والتنظيمية

Implementing advanced technical measures such as encryption, access controls, and intrusion detection systems, along with organisational measures like policies and procedures to enhance cybersecurity.

تأثير NIS2 على تطوير البرمجيات

NIS2 primarily mandates strengthening protection against cyberattacks through both technical and organisational, emphasizing a Security by Design approach. This means that security must be seamlessly integrated into the product rather than treated as an afterthought. It needs to be considered from the initial design phase onward. While this approach has been recognised previously, its consistent application across all industries has been variable. Often, it has been viewed as a competitive edge rather than a standard. By embedding security considerations early in the design phase, organisations can address potential vulnerabilities and mitigate risks proactively.

Fundamental to software development under the NIS2 Directive is risk assessment and cybersecurity management throughout the lifecycle of the product or service post-development. NIS2 requires companies to monitor cybersecurity changes, new attack methods, and adapt their defences accordingly. This significantly impacts the design and development of the product or service.

Other considerations during development include identity management and data control, which are critical to ensuring compliance with data protection regulations and maintaining trust with stakeholders.

For companies seeking certification of their products, adherence to the NIS2 Directive becomes imperative. Certification requires demonstrating compliance with cybersecurity standards and practices outlined in the Directive to prove that an organisation is commitment to protecting against cyber threats effectively.

تعرّف على متطلبات الأمن السيبراني الجديدة بالتفصيل

احصل على دليلنا
NIS2 Guide ebook cover mockup
احصل على دليلنا

تأثير NIS2 على صناعة السيارات

الـ صناعة السيارات هي من أفضل الصناعات استعدادًا من حيث تلبية متطلبات التوجيه الجديد، إذكان على المنتجات أو الخدمات بالفعل الامتثال للوائح الخاصة بالقطاع المتعلقة بالأمن السيبراني, such as R155 and R156. The UNECE WP29 Group, which aims to harmonise vehicle regulations, recently issued Regulation R155/R156, mandating new vehicle manufacturers to implement a Cybersecurity Management System from 2024. Additionally, concerning update management, R156 requires the implementation of a Software Update Management System (SUMS), with best practices described in ISO 24089. Automotive companies also have dedicated cybersecurity teams covering various areas within their structures. 

The remaining issue to address regarding the NIS2 Directive is establishing an effective communication system for reporting data breaches. As vehicles increasingly collect and transmit data to the cloud, they face potential cybersecurity vulnerabilities. In the event of a data breach, responsible entities must promptly notify both relevant authorities in their member state and affected customers.  

تأثير NIS2 على قطاع الرعاية الصحية

في قطاع الرعاية الصحية, cybersecurity has long been a standard practice. An additional aspect introduced by NIS2, similar to the automotive industry, is a stricter requirement for incident reporting. The Directive emphasises improved incident response, increased accountability at the board level, and regular monitoring and auditing. Additionally, NIS2 expands the scope to encompass more healthcare entities, including hospitals, clinics, pharmaceutical companies, and medical device manufacturers. 

أثر توجيه NIS2 على شركات الصناعة 4.0

حتى الآن، كانت الأمن السيبراني في المقام الأول ميزة تنافسية لـ الصناعة 4.0 sector companies. Now, it has become a necessity to sell products in the European market. Customers demand transparency from manufacturers regarding the cybersecurity solutions implemented in their products or services. While adapting to NIS2 poses challenges in governance and technical adjustments, it also presents opportunities to enhance market credibility and resilience against cyber threats. 

In summary, the automotive, healthcare, and Industry 4.0 sectors are already well-prepared in terms of cybersecurity during the development phase. However, the challenge they still face under the new Directive is establishing cybersecurity responsibilities, developing an incident reporting and response system, and implementing monitoring and auditing solutions. 

كيف يمكن لخدماتنا مساعدة شركتك على تلبية متطلبات توجيه NIS2؟

We are a one-stop-shop for cybersecurity services – from embedded software solutions, to data security (ISO 27000 and TISAX). Our software developers and architects are well-versed in cybersecurity requirements. We have a team of pentesters who can assess the resilience of your organisation, product, or service against cyberattacks. Our experts have extensive experience in analysing processes within companies to identify areas that need improvement in terms of cybersecurity, including threat monitoring, risk analysis, product and service development, and vulnerability testing. We also assist our clients in defining and implementing these processes in accordance with industry best practices. Furthermore, we help companies successfully deploy these solutions. Additionally, we support firms in transitioning through third-party audits or certification processes.  

تواصل معنا عبر النموذج أدناه لضمان توافق تدابير الأمن السيبراني لديك مع توجيه NIS2.

The NIS2 Directive is an EU regulation designed to strengthen and harmonise cybersecurity standards across member states. It aims to increase resilience and protect critical sectors from evolving digital threats.

NIS2 applies to essential and digital service providers such as energy, healthcare, transport, banking, and cloud computing, as well as public administration bodies. Non-EU companies offering services in the EU must also establish a local legal entity.

Its goals include improving risk management, enhancing incident reporting, expanding coverage to more sectors, and increasing accountability for cybersecurity. It also promotes cooperation between EU states to handle cross-border threats.

It enforces a “Security by Design” approach, requiring security to be integrated from the earliest design stages. Developers must continuously assess risks, monitor new threats, and maintain secure product lifecycles.

Spyrosoft offers end-to-end cybersecurity services, including risk assessments, penetration testing, and compliance support. Our experts help companies align processes, develop secure solutions, and prepare for audits or certifications under NIS2.

arrow_circle_right جدول المحتويات

Małgorzata Kruszyńska

Malgorzata Kruszynska

باحث أعمال

مقالات ذات صلة