The European market for operational technology (OT) is growing at a rate of 7% a year and will be worth US$9 billion by 2028.
Across Europe, manufacturers and operators of infrastructure have invested in connected devices and services. Bringing networked intelligence to the factory floor like this can increase productivity by the equivalent of an extra $1 per square meter per day.
Now it’s time to protect that investment — and the need to do so is increasingly urgent. In December 2022, the EU Commission published the revised Network and Information Systems Directive, commonly known as NIS2.
Is your cybersecurity posture ready for NIS2?
Even if your facilities were already covered by, and compliant with, the original NIS directive of 2016, you need to pay attention to NIS2, because it introduces some important changes.
What’s new in NIS2? Among other things, the following are new in NIS2:
- The directive applies to new sectors — such as water, waste management, critical manufacturing and more — not covered by the original NIS directive.
- Any entity that falls under NIS2 must have risk analyzed its cybersecurity posture, then developed and documented security processes and incident-handling procedures.
- The supply chain is now covered, so affected entities must assess the security of their supply chain and create appropriate risk management measures.
- Incident-notification rules are stricter. Entities must notify authorities of a suspected malicious act affecting their IT or OT networks within 24 hours.
All these new rules, and more, will be transposed into local law by each of the EU member states no later than 17 October 2024. Across the EU, parliaments are working on new legislation to bring NIS2 into force.
If you operate a factory or a major piece of infrastructure, you need to ask yourself if your cybersecurity posture is ready for these changes.
Securing OT networks can be complicated. The average factory or piece of infrastructure may have thousands of connected sensors and devices. Often, these are old and may not have been patched or designed with cybersecurity in mind.
These connected devices may also be undocumented, and therefore outside the scope of regular maintenance and security updates. This leaves the organization doubly vulnerable — unable to comply with NIS but also ignorant of this fact.
Fixing these problems gains an added urgency when you consider the consequences of inaction. Under NIS2, executives are personally accountable for data breaches. And the company itself can be fined up to €10,000,000 or 2% of their global annual revenue.
