NIS 2 and Security Maturity Assessment: A speed race towards Cybersecurity maturity

Small and medium-sized enterprises (SMEs) are the foundation of the European Union’s economy. They make up 99% of all businesses in the EU and provide employment to around 100 million people. Moreover, they contribute more than half of Europe’s GDP and are a crucial factor in adding value to all sectors of the EU’s economy, as stated by the European commission. Therefore, SMEs are at the core of the EU’s transition to a sustainable and digital economy. They are vital to Europe’s competitiveness and prosperity, as well as its industrial ecosystems, economic and technological sovereignty.

Largely due to the impact of the COVID-19 pandemic on the social and economic landscape traditional businesses were physically forced to abruptly move to digital procedures such as remote working through online collaboration platforms, e-commerce, e-banking and e-government services for maintaining business operations. Digital transformation became a necessity towards business continuity. However, many SMEs omitted to embrace cybersecurity. At the same time the more advanced technology becomes, the more sophisticated ways cybercriminals adopt to access sensitive data, AI being their right hand. Cybercriminals take advantage of vulnerabilities to invade business’s endpoints, workstations and systems.

Contrary to the common perception that cyber-attacks occur only against large organizations, all organizations can be similarly attacked, no matter what their size. Phishing, poor cyber hygiene, configuration mistakes, ransomware seem to be amongst the top cybersecurity threats for 2023, as identified by experts. Of the SMEs ENISA surveyed, 90% stated that cybersecurity issues would have serious negative impacts on their business within a week of the issues happening, with 57% saying they would most likely become bankrupt or go out of business. It seems inevitable that in today’s rapidly evolving digital landscape, businesses must be vigilant and proactive in their efforts to safeguard their assets and reputation from cyber threats. However, a major question arises.

Are businesses mature enough to effectively embrace cybersecurity, or are they still grappling with immaturity in their approach to security?

Business cybersecurity immaturity can be identified by a few common signs. They often lack vital executive buy-in and leadership support. Moreover, they fail to invest sufficiently in cybersecurity resources, technologies and skilled staff and rely on reactive and ad-hoc security measures instead of a strategic and holistic approach. Last but not least, they display limited awareness of cyber risks and best practices.

The lack of maturity in businesses’ approach to cybersecurity may carry significant implications. These may include increased vulnerability to cyber attacks and data breaches, higher chances of regulatory non-compliance, legal repercussions, damage to reputation and brand trust in case of a security breach, disruption to business operations, financial losses and potential business failure.

NIS 2 forces towards Cybersecurity maturity

NIS2, or the Network and Information Security Directive 2, plays a significant role in pushing businesses towards cybersecurity maturity by establishing mandatory clear requirements, promoting best practices and fostering a culture of security awareness. The three main pillars of NIS 2 are to enhance EU Member State responsibilities to pay due attention to cybersecurity, to increase companies’ responsibility to take security measures and report incidents within the given time frame and to strengthen cooperation and info exchange among cybersecurity authorities. It includes “Essential” and “Important” entities depending on size, sector and criticality, critical sectors being energy (electricity, district heating and cooling, petroleum, natural gas, hydrogen), transport (air, rail, water, road), banking, financial market infrastructure, health (which no longer only includes hospitals but now also includes reference laboratories, medical device or pharmaceutical preparation manufacturers and others), drinking water, waste water, digital infrastructure, ICT service management, public administration (central and regional), space, postal and courier services, waste management, manufacture, production and distribution of chemicals, production, processing and distribution of food, manufacturing (of medical devices and in vitro diagnostic medical devices; computer, electronic and optical products; electrical equipment; machinery and equipment, motor vehicles, trailers and semi-trailers; other transport equipment), digital providers, research.

By 17 October 2024, EU Member States must adopt and publish the measures necessary to comply with the NIS 2 Directive (The NIS 2 Directive). Consequently, Εssential and Important entities have the responsibility of immediately implementing appropriate and proportional technical, operational and organizational measures to effectively manage and mitigate risks to their systems. This includes preventing or minimizing the impact of any incidents on their services and other affiliated services. Such measures must include the following:

• Risk analysis and information systems security policies
• Incident handling
• Business continuity, such as backup management and disaster recovery, and crisis management
• Supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers’ or service providers’ security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure
• Policies and procedures to assess the effectiveness of cybersecurity risk-management measures
• Basic cyber hygiene practices and cybersecurity training
• Policies and procedures regarding the use of cryptography and, where appropriate, encryption
• Human resources security, access control policies and asset management
• The use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate

“Security Maturity Assessment” by Neurosoft

Neurosoft, as a leading Managed Service Provider (MSP), helps businesses enhance their cybersecurity posture, strengthen their security capabilities and comply with NIS 2 Directives. Our Cyber Security Technology Advisory (CTA) Services created a brand-new, top-notch offering called “Security Maturity Assessment“. This service is designed to assist businesses in implementing a mature and effective cybersecurity strategy in several ways:

• Cybersecurity Assessment and Gap Analysis: We conduct comprehensive cybersecurity assessments to evaluate the organization’s current security posture, identify vulnerabilities and assess compliance with industry standards and regulations. Moreover, we perform gap analysis to highlight areas where the organization falls short in terms of cybersecurity maturity and recommend remediation measures.
• Strategic Planning and Roadmap Development: We collaborate with each organization to tailor a strategic cybersecurity roadmap aligned with business objectives, risk tolerance and regulatory requirements. Clear goals, milestones and action plans are defined for enhancing cybersecurity maturity over time.
• Policy and Procedure Development: We assist in developing and implementing robust cybersecurity policies, procedures and guidelines tailored to the organization’s specific needs and regulatory obligations. Additionally, we ensure that policies cover areas such as data protection, access control, incident response, business continuity and employee security awareness.
• Security Awareness Training: Our experienced consultants provide cybersecurity awareness training and education programs for employees at all levels to raise awareness of cyber risks, promote best practices and foster a culture of security. In addition, we offer simulated phishing exercises and other interactive training modules to help employees recognize and respond to security threats effectively.

Overall, Neurosoft can serve as a trusted partner and advisor to businesses seeking to enhance their cybersecurity maturity and resilience. By leveraging our expertise, resources and services, organizations can strengthen their security posture, reduce cyber risks and achieve greater confidence in their ability to protect against modern cyber threats and accomplish business continuity and growth.