How to Stay Secure While NIS2 Takes Its Time

What could the delayed implementation of NIS2 mean for you now?

Introduction

The Network and Information Security Directive 2 (NIS2) was intended to set a new standard for cybersecurity in the European Union, improve the resilience of critical infrastructure, and harmonize security practices. However, local law implementation has been delayed in several EU countries due to domestic political tensions, some new elections, or unsuitable government coalitions. This delay significantly impacts cybersecurity in those companies and authorities affected by and exposed to regulatory uncertainty and increases the responsibility of organizations to better ensure cyber resilience themselves.

The cost of delay: endangering critical infrastructure

NIS2 addresses security vulnerabilities in critical sectors, from energy and healthcare to transportation and telecommunications. The implementation of NIS2 into national law has been uneven across the EU, with only six countries – including Belgium and Italy – meeting the October 17, 2024 deadline. In particular, Germany and France, the EU's economic engines, must catch up, making it difficult to prioritize this regulation. Delays in implementing these frameworks create a vacuum in cybersecurity regulations and mainly increase the risks of:

Fragmented cybersecurity standards:

Organizations can stick to outdated or inconsistent practices without consistent rules, making cross-border cooperation difficult and leaving gaps in collective defense strategies. This comes with regulatory uncertainty, as companies face compliance issues and must know whether to adapt to NIS2 standards or continue with existing frameworks as a precautionary measure. This uncertainty is further slowing the adoption of advanced cybersecurity technologies.

Increased security vulnerabilities for zero-day attacks, APTs, and supply chain attacks:

National actors and cybercriminals often target sectors with weak regulatory oversight. Disjointed cybersecurity measures allow attackers to exploit vulnerabilities throughout the supply chain, with cascading effects. This, along with geopolitical uncertainty worldwide, hits Europe very hard, too.

The broader implications for European cybersecurity

1. Lagging readiness: Countries that delay NIS2 integration risk lagging in cybersecurity maturity, making them prime targets for cybercriminals.
2. Growing cybersecurity gaps: Critical sectors in these regions can become vulnerable, which could undermine the security of the entire European Union.
3. Technological lag: Once NIS2 is adopted, organizations that have yet to proactively invest in modern cybersecurity tools will face steep learning curves and high costs to meet compliance deadlines.

Why NDR and Zero Trust are more important today than ever before

It offers The delayed implementation of the NIS2 directive underlines the urgency of proactive cybersecurity measures. Technologies such as Network Detection and Response (NDR) with machine learning, User and Entity Behavior Analytics (UEBA), and the consistent application of a Zero Trust strategy play a crucial role. They help to bridge delays in security implementation, compensate for differences in security maturity between companies, and minimize technological backlogs. This enables organizations to effectively address their security risks despite regulatory delays and sustainably strengthen their cyber defenses.

NDR: Closing the transparency gap

Without the monitoring standards prescribed by NIS2, many companies do not have a comprehensive overview of their network. NDR solutions provide real-time visibility into network traffic and detect anomalies and threats that may go unnoticed, especially in IT and network environments.

The transparency that is created with the use of such solutions shows the weaknesses in the existing security measures and helps the company to develop a concrete investment plan and security strategy planning. The use of various manufacturer solutions can be optimized and the entire risk strategy can be adapted. This ultimately goes hand in hand with the requirements arising from the various compliance requirements. NDR is crucial for the early detection of threats such as APTs, ransomware, and lateral movement. It provides protection for unmanaged and IoT devices that are often overlooked by traditional tools. It ensures continuous monitoring across hybrid and segmented networks, which can also be critical for supply chain vulnerability detection. NDR also detects insider threats by analyzing user and entity behavior to identify anomalies such as credential theft and data exfiltration. As delays in NIS2 enforcement leave gaps in cybersecurity, NDR provides contextual alerts to focus on real risks, especially in legacy systems.

Zero Trust: A security model for uncertain times

Zero Trust works on the principle of “Never Trust, Always Verify” and continuously monitors and verifies access to systems and data to increase security. This approach is now critical as it provides a reliable, enterprise-led solution for securing sensitive systems, enabling granular access control in distributed environments and mitigating supply chain vulnerabilities—a key focus of NIS2.

NDR complements Zero Trust by providing real-time visibility of all network activity. It ensures that every device and user interaction within the network is continuously monitored and analyzed for anomalies. By identifying and isolating suspicious behavior, NDR enforces the “least privilege” principle and strengthens the segmentation required for a robust Zero Trust architecture.

A decisive improvement of the Zero Trust model with NDR is the addition to asset management models. The comparison to the actual/target comparison in near real time with automation to supplement it is of relevant importance in any zero trust model.

Conclusion: A call for proactive action

The delayed implementation of NIS2 underlines the urgent need for companies to take cyber security into their own hands. Waiting for the regulatory environment to catch up is not an option in today's threat landscape.

Cyber defense technologies and essential strategies are pillars for building resilience in the face of uncertainty. By adopting these solutions, organizations can protect themselves, safeguard critical data, and ensure business continuity, regardless of regulatory delays.