Only 30% of EU member states have fully implemented The Network and Information Security Directive (NIS2), with attention divided among NIS2, the Digital Operations Resilience Act (DORA), and the European Cyber Resilience Act (CRA). This has led to missed target deadlines, putting businesses at risk of falling behind the adoption curve.
NIS2, the most significant cybersecurity legislation in over a decade, aims to establish secure digital infrastructure across the EU. While the deadline for compliance has passed, the phased approach across Europe is reminiscent of the introduction of GDPR in 2016.
Businesses in the UK are not required to comply with NIS2, but those with EU-based clients or involved in EU supply chains will need to adhere to its standards.
Mitun Zavery, Vice President of Solution Architecture at Sonatype, emphasizes the importance of cybersecurity reporting standards introduced by NIS2. Companies must report major incidents within 24 hours, with updates in 72 hours and a final report in 30 days. Compliance with these standards is crucial for protecting shared systems and data.
The observability conundrum highlights the increasing threat of bad actors targeting software supply chains. NIS2 aims to hold businesses personally accountable for cybersecurity, addressing the gap between software consumption and component observation.
As regulations evolve to address vulnerabilities in software supply chains, UK businesses should prepare for upcoming legislation like the CRA Bill to stay competitive and safeguard against cybersecurity incidents.
Ultimately, proactive measures to enhance cybersecurity resilience are essential for protecting businesses from compliance failures and reputational damage.