What the NIS2 Directive means for the Adriatic region
An a&s Adria feature on whether companies in the region are ready for NIS2, from the shortage of experts to compliance that exists only on paper.
This feature by Mirza Bahić in the September 2024 issue of a&s Adria asks whether companies across the Adriatic region are ready for NIS2, the European cybersecurity directive that also reaches businesses outside the EU through the supply chains of European companies. It gathers experts and business leaders from the region, and Branko Džakula speaks as IT director at BrightMarbles Group and co-founder and CEO of UN1QUELY.
Džakula sees great unreadiness among companies in the EU candidate countries of the Western Balkans, which he says is evident from the many successful cyberattacks on state infrastructure in recent years and reflects a shortage of cybersecurity experts and inadequate measures for repairing the damage after an attack. He expects the main challenge to be finding staff who can implement and maintain information security systems fully aligned with ISO 27001 and the specific NIS2 controls. He doubts that the existing practice of treating ISO 27001 as a condition for working with large companies will carry over to NIS2, and expects the higher costs to be justified through more advanced security practices, since advanced controls increasingly come with the enterprise subscription plans of SaaS products.
For him, a bigger problem than the cost could be fictitious compliance of the kind that appeared after GDPR, with companies becoming compliant on paper overnight and without real investment, then advertising it on their websites, which will be hard to check without inspectors and staff for continuous oversight. For companies outside the EU, he says the penalty could mean lost contracts, a possible ban on providing services in the EU and management liability, while hiding incidents to protect a company’s reputation only digs a deeper hole, because the directive sets short reporting deadlines. On the technical side he points to SIEM, advanced antivirus for computers and servers, network protection and continuous vulnerability testing of software and internal networks, which companies often hand over to managed security providers.
Key findings
- 01Companies in the EU candidate countries of the Western Balkans are largely unready for NIS2, as the many successful cyberattacks on state infrastructure in recent years show.
- 02The main challenge is staff who can implement and maintain information security systems fully aligned with ISO 27001 and the specific NIS2 controls.
- 03Advanced security controls are increasingly part of the enterprise plans of SaaS products, a trend he expects to grow.
- 04The risk to watch is fictitious compliance, as after GDPR: compliance on paper, advertised on websites and hard to verify without inspection capacity.
- 05For companies outside the EU, non-compliance can mean lost contracts, a ban on providing services in the EU and management liability.
- 06Hiding incidents digs a deeper hole, because NIS2 requires an initial report within 24 hours, a detailed report within 72 hours and a final report after a month.