NIS2: Essential step towards a more cyber-secure Europe requires more cyber expertise

The war in Ukraine has made it painfully clear that cyber security is vital to Europe's future --  to its citizens, industry and society. The new NIS2 Directive aims to create a broad cyber security awareness. In addition to most central government departments, many companies have also been affected. While the existing NIS1 directive primarily covered a number of critical sectors, such as energy and telecom, almost all sectors are now covered by the NIS2 directive, including the Agoria sectors of manufacturing and the ICT sector.

A GDPR Directive for Cybersecurity

By analogy with the personal data processing policies that companies and governments have developed since the GDPR, this framework will also require companies to have a specific cyber security policy. That policy will require a risk analysis, incident handling procedures, taking mitigating measures as well as business continuity plans in line with the identified risks. Staff training and awareness is also a necessary component. Finally, the security of supply chains is also a crucial element of the directive. There will also be an obligation to report security incidents. Companies will therefore have to develop a cyber security plan with all these elements in accordance with the NIS2 Directive.

Proportionality for SMEs

The applicability of NIS2 is therefore determined by the sector to which a company belongs, but also by the size of the company. With a view to proportionality, a "size cap" was built in. Broadly speaking, only large and medium-sized companies will be accountable under NIS 2. The Member States can still deviate from this in order to include small or even micro-enterprises in the scope of the directive. Although all companies should actually have a cyber security plan, it is best to take into account the feasibility for small companies. For example, in the scope and size of the plan.

More cyber experts and a strong cyber industry 

The NIS2 will require many more companies and organizations from roughly all sectors to implement a more complex set of obligations. This will require more cyber knowledge, more cyber experts and a strong cyber industry to meet the demand. However, according to current estimates, there is a major shortage of 200,000 and of 5,000 to 7,000 cyber experts in Europe and Belgium respectively. Agoria therefore calls upon the competent authorities to interact with the various sectors and in particular with the sector of cybersecurity companies and the cyber industry, so as to raise awareness and provide guidance, but especially in order to work together for more qualified cyber experts and a strong cyber industry.