Q: In your opinion, which specific NIS2 Security requirement (Article 21) poses the greatest challenge for companies to address, and why?
A: It really depends on the company, and supply chain cybersecurity is a hot topic here. However, what also seems to become challenging is the level of involvement and knowledge needed from the board, including how to train them so that they are able to make the best possible decisions when it comes to cybersecurity.
Q: What recommendations would you offer to companies that are in the process of deploying NIS2?
A: It’s always good to just get started. To that end, the ILR has published a set of six fundamental measures.
Do not wait until a perfect plan and strategy is finalized, because an incident could happen at any time. Identify the crown jewels and see what you can do quickly to improve your security. Setting priorities is crucial, as one cannot work on everything at the same time.
Right from the start, the ILR has been following a collaborative approach, encouraging information sharing with entities, and also within and among sectors. Only together we are able to increase our level of cybersecurity.
Informed governance is another key word here. Risk assessments should no longer be an individual effort; they should leverage a common understanding of threat vectors and vulnerabilities, so that decisions regarding treatment plans are consistent across similar scenarios, regardless of who is doing the assessment. A common understanding and wider knowledge of how to evaluate a certain risk needs to be established.
Q: NIS2 introduces the risk assessment of supply chain security as a new area. What do you foresee as the main challenges that companies will face regarding this topic?
A: Entities will have to start negotiations on the level of cybersecurity with their suppliers. This can be a disadvantage for smaller entities that have to do this exercise with large multi-national companies.
Q: From a national authority or regulator perspective, what do you consider to be the most significant changes introduced in NIS2 compared to the original NIS Directive?
A: The removal of the identification process for essential or important entities (entities falling by default under NIS2) and the liability of the management board are the biggest changes in our view.
Beyond Compliance: Strengthening Cyber Resilience with NIS2
Just like the Portuguese National Cybersecurity Centre (CNCS) in their country, the ILR plays a pivotal role in shaping Luxembourg’s compliance strategy, guiding critical and essential entities through the directive’s requirements. As the regulatory body, they ensure that NIS2’s objectives are met, from bolstering supply chain security to strengthening incident reporting and risk management practices.
The path to compliance starts with understanding the directive and breaking it into achievable steps. The insights shared in this blog reveal the real-world challenges of compliance and uncover the opportunities for organizations to turn NIS2 from a regulatory obligation into a cornerstone of cyber resilience. To learn more, download our NIS2 Compliance Playbook.
