The new cybersecurity paradigm in Europe
The current digital environment presents risks that transcend mere data loss. For business owners and executives of large organisations, cybersecurity has ceased to be a purely technical matter to become a risk to governance and business continuity. In this context, compliance with the NIS2 Directive emerges as an imperative regulatory framework that redefines the obligations of entities within the European Union.
The NIS2 Directive is not a suggestion, but a mandate that seeks to strengthen the resilience of essential and highly critical sectors. Unlike previous regulations, this legislation introduces a more holistic vision, where risk management must be integrated into corporate strategy. For Spanish companies, understanding the scope of this regulation is fundamental to avoiding operational disruptions and potential legal consequences.
Scope and sectors affected by the regulation
One of the main points of interest for executives is determining whether their organisation is subject to these obligations. The NIS2 Directive significantly expands the spectrum of entities that must comply with security standards. The focus is on sectors whose disruption would have a serious impact on society or the economy.
Among the sectors that usually fall into the essential or highly critical category are energy, transport, banking, health, water supply, and public administration. However, the regulation also covers sectors that, although not traditionally considered critical, play a vital role in the digital economy, such as data service providers or digital platforms.
To determine applicability, it is necessary to evaluate whether the company meets certain size criteria, such as the number of employees or turnover volume, or if its activity is considered strategic by national authorities. Because specific criteria may vary according to national transposition, it is recommended to perform a technical assessment to confirm the entity’s position.
Responsibility of senior management and governance
A radical change introduced by NIS2 compliance is the direct responsibility of governing bodies. The regulation establishes that company management is in charge of supervising the implementation of cybersecurity risk management measures.
This means that directors cannot delegate final responsibility to the IT department. Cybersecurity must be treated as a business risk, similar to financial or legal risks. Executives must ensure that the organisation has the necessary resources, that adequate training is carried out, and that clear incident response protocols exist.
A lack of supervision or the absence of a cybersecurity strategy aligned with company objectives can lead to personal and corporate liabilities. Therefore, integrating cybersecurity into the company culture is an indispensable compliance requirement.
Risk management measures and supply chain security
NIS2 compliance requires the adoption of technical and organisational measures proportional to the risk. These measures are not static; they must evolve as threats become more sophisticated. The pillars of these measures include incident management, business continuity, and communication security.
A critical aspect highlighted by the directive is supply chain security. Organisations can no longer ignore the security posture of their suppliers. An attack on a software or cloud services provider can compromise the integrity of the entire client company network. Therefore, compliance involves:
- Conducting security audits of key suppliers.
- Establishing strict contractual clauses regarding cybersecurity.
- Periodically evaluating the resilience of business partners.
- Implementing robust access controls and authentication for third parties.
This holistic vision seeks to close the gaps that attackers often exploit by targeting the weakest links in the value chain.
Incident management and mandatory notification
The ability to respond to an incident is a key indicator of an organisation’s maturity. The NIS2 Directive imposes strict notification obligations when an incident is detected that has a significant impact on the provision of services.
The notification process usually follows a staged scheme. Initially, an early warning must be issued to the competent authorities. Subsequently, an intermediate report is required, and finally, a detailed report that analyses the causes and the measures adopted. The objective of this rigour is to allow authorities to coordinate a European-level response to cross-border threats.
Failing to meet notification deadlines or failing to adequately report the magnitude of an incident can aggravate the company’s legal situation. Transparency and speed in communication are, therefore, essential elements of a compliance strategy.
Steps to initiate the compliance process
For companies seeking to align with NIS2 compliance, it is recommended to follow a structured process that minimises uncertainty. Although each organisation is unique, the following steps constitute a solid foundation for the transition:
- Perform a situation diagnosis or gap analysis to identify differences between current practices and the directive’s requirements.
- Classify the entity according to its sector and size to confirm the applicable level of requirement.
- Evaluate the supply chain and the risks associated with critical suppliers.
- Develop or update the cybersecurity risk management plan.
- Establish communication and incident notification protocols.
- Implement training programmes for senior management and key personnel.
- Establish a continuous monitoring system to ensure the effectiveness of the adopted measures.
This process requires close collaboration between the legal, technical, and operations departments.
Final considerations and professional advice
Compliance with the NIS2 Directive represents a major operational and legal challenge. It is not merely about installing security software, but about transforming the organisation’s risk management and ensuring that senior management assumes its role in digital governance.
The complexity of the regulation and the possibility of significant sanctions make the management of this process delicate. In situations where the interpretation of the rule or the implementation of technical and legal controls generates doubts, it is fundamental to have the support of experts. At BMC, we assist companies in assessing their risks and designing compliance strategies that ensure the continuity of their activity and the protection of their most valuable assets.