NIS2 Directive requirements

What is the NIS2 Directive?

The NIS2 Directive establishes EU-wide cybersecurity legislation, building on the original Network and Information Security (NIS) Directive. Its primary goal is to standardize cybersecurity measures across all EU Member States, fostering a unified approach to protecting digital infrastructure. NIS2 seeks to align efforts across the EU in addressing the increasing threat of cyberattacks by promoting best practices and consistent security standards.

To be compliant with the NIS2 Directive, organizations must enforce the security requirements discussed in the sections below.

New organizational requirements of the NIS2 Directive

The NIS2 Directive aims to enhance Europe’s resilience to current and emerging cyberthreats by introducing new mandates for organizations across these four main areas:

• Risk management

  Organizations must take measures such as incident management, stronger supply chain security, enhanced network security, better access control, and encryption to minimize cyber risks.

• Corporate accountability

  Corporate leadership is required to oversee, approve, and participate in cybersecurity training. If security incidents are not properly addressed, the management team may face penalties.

• Reporting obligations

  Essential and important entities must promptly report significant security incidents within the NIS2-mandated specific notification deadlines, such as the "early warning" requirement within 24 hours.

• Business continuity

  Organizations must prepare a business continuity plan for major cyber incidents, covering system recovery, emergency procedures, and establishing a crisis response team.

The 10 minimum security measures of the NIS2 Directive

Beyond the four key requirement areas, NIS2 requires essential and important entities to implement these baseline security measures targeting specific cyberthreats:

• Comprehensive risk assessment

  Organizations must have risk assessments and security policies tailored to their information systems. These assessments should thoroughly evaluate potential threats, vulnerabilities, data sensitivity, system architecture, and attack vectors.

• Advanced authentication

  Organizations must implement measures like MFA, continuous authentication solutions, and text encryption, as needed.

• Incident response plan

  An incident response plan must be developed to address potential security breaches quickly. It should outline rapid actions to mitigate risks and protect sensitive assets from unauthorized access or compromise.

• Security effectiveness

  Organizations must set up policies to evaluate the effectiveness of their security measures regularly. This includes routine audits to assess security protocols, identify vulnerabilities, and ensure the overall strength of your security infrastructure.

• Access control management

  Security procedures must be implemented for employees who have access to sensitive data, and policies must be established for data access. Organizations must maintain an overview of all relevant assets to ensure they are utilized and managed effectively.

• Encryption policies

  Policies must be created for using cryptography and encryption to manage sensitive data, outlining guidelines for protecting data at rest, in transit, and during processing.

• Disaster recovery

  A backup and recovery plan to maintain business operations following a security attack must be developed. Regular backups must be conducted, and a strategy for managing access to IT systems during and after an incident must be established.

• Security measures

  Organizations must ensure the secure procurement, development, and operation of systems and establish policies for managing and reporting any vulnerabilities that might arise.

• Supply chain risk management

  Organizations must implement stringent security measures for supply chains tailored to the vulnerabilities of each direct supplier and evaluate the overall security levels of all suppliers.

• Cybersecurity training

  Organizations must provide training to both management and employees to improve their understanding of cybersecurity.

Meet the requirements of the NIS2 Directive using ADSelfService Plus

ADSelfService Plus' adaptive MFA and strong password policies

ADSelfService Plus provides adaptive MFA and strong password policies, ensuring your organizational identities are effectively secured for a comprehensive Zero Trust environment. The following are some highlights of ADSelfService Plus' Password Policy Enforcer and adaptive MFA capabilities:

1. Enforce password history and complexity: Strengthen passwords by enforcing password history during native password resets in the Windows Active Directory Users and Computers (ADUC) console. Ensure passwords contain uppercase, lowercase, special, and numeric characters.
2. Ban weak passwords: Block leaked or weak AD passwords, patterns, and palindromes.
3. MFA for applications and endpoints: Secure user access to organizational data by enabling MFA for endpoints such as machines, enterprise applications, VPNs, RDPs, and OWAs.
4. Multiple MFA authenticators: Choose from a range of 20 different MFA authenticators, like FIDO passkeys, biometrics, and YubiKey authenticator, to verify users' identities.
5. Easy configuration: Simplify the MFA enrollment process for both admins and users using quick enrollment options, like email or push notifications and CSV file imports, and enforce different MFA methods for users based on OUs and groups.

Benefits of using ADSelfService Plus to comply with NIS2 requirements

• Strong MFA techniques: Implement adaptive MFA techniques, like conditional access and customizable trust options, to authenticate users based on their location, IP address, and device type.
• Fine-grained flexibility: Enforce different MFA settings for users with varying levels of access to sensitive organizational data based on their OUs or groups.
• Increased password security: Ensure all-around protection from cyberattacks with the help of strong password policies that enforce passphrases and restrict common patterns from passwords.
• Compliance with regulatory standards: Ensure that your organization complies not only with the NIS2 Directive, but also with NIST SP 800-63B, HIPAA, PCI DSS, CJIS, SOX, and the GDPR compliance mandates.