RiskTalk: How to prepare your business for NIS2

The introduction of the European NIS2 Directive presents businesses with a significant challenge in strengthening their digital resilience. In the fourth episode of 3rdRisk’s RiskTalk podcast, three experts discuss the impact and practical implications of NIS2. Jasper Nagtegaal, Director of Digital Resilience at the Dutch Authority for Digital Infrastructure, shares insights from his regulatory perspective. Willem van der Valk, cybersecurity and privacy expert at Eraneos, offers real-world advice on implementing NIS2. Finally, Bram Ketting, co-founder of 3rdRisk, highlights how companies can collaborate across the supply chain to bolster security.

What is NIS2, and why does it matter?

NIS2, an initiative by the European Union, expands upon the original NIS Directive with stricter requirements for securing digital systems and infrastructure. It applies to a broader range of sectors and establishes clearer guidelines for supply chain management, risk management, and board-level responsibilities. Jasper Nagtegaal explains the directive’s importance: “NIS2 is a boost for Europe’s resilience and a necessary step towards making organisations more robust against cyber threats.”

The three pillars of NIS2: What do they mean for your organisation?

To support businesses in building an effective cybersecurity strategy, NIS2 focuses on three critical areas:

1. ‍Supply chain management. Companies must ensure the digital resilience of their entire supply chain, addressing not only internal security but also the standards of their suppliers and partners. Bram Ketting notes: “It’s about creating an ecosystem. By collaborating with suppliers and partners, businesses can build a stronger, more secure network together.”‍
2. Risk management as a core principle. NIS2 emphasises a risk-based approach, encouraging organisations to address vulnerabilities proactively rather than reactively. Willem van der Valk states: “Businesses need to look beyond IT departments and embed risk management across the organisation. This requires both technical measures and a cultural shift.”‍
3. Board-level accountability. The directive requires executive leaders to take an active role in cybersecurity. Boards are expected to make informed strategic decisions and take responsibility for the organisation’s digital resilience. Willem underscores the shift in mindset required: “Cybersecurity is no longer just an IT issue; it’s a company-wide responsibility.”

Practical steps for implementing NIS2

For compliance and risk professionals, effective NIS2 implementation involves these actionable steps:‍

• ‍Leverage Existing Frameworks. Businesses with existing measures like ISO certifications can use these as a foundation. Aligning current procedures with NIS2 requirements streamlines the process. Willem advises: “Many organisations have already made progress. It’s often a matter of adjusting these to meet NIS2’s standards.”
• ‍Standardise processes. NIS2’s scope across the supply chain makes standardisation essential for efficiency and consistency. Jasper highlights: “A shared standard benefits everyone. It reduces errors and ensures clarity throughout the supply chain.”
• ‍Engage leadership. Executive buy-in is critical. Leaders need training in risk management and a clear understanding of the required measures. Willem adds: “If boards still see cybersecurity as just an IT responsibility, there’s a fundamental issue to address.”

NIS2: A catalyst for european cybersecurity

NIS2 aims to strengthen the digital resilience of European businesses and minimise the impact of cyber threats. Jasper believes it offers more than just a legal obligation: “NIS2 is a chance for organisations to fundamentally improve their security posture, not just comply with regulations.” The directive represents a vital step toward managing risks holistically. By collaborating with partners and adopting robust measures, businesses can contribute to a safer digital landscape.

Tune in to RiskTalk

Want to understand NIS2’s implications and learn actionable strategies for compliance? Listen to this episode of RiskTalk, where Jasper, Willem, and Bram share insights, practical steps, and real-world examples. Gain the knowledge to protect your organisation and strengthen its digital resilience.