Cybersecurity front Companies are struggling with the new NIS-2 directive

Related Vendors

FAULHABER Drive Systems

dataTec AG

Wuxi InfiMotion Technology Co., Ltd.

From October 17, the new NIS-2 directive, which imposes higher cybersecurity requirements on them, applies to companies in the EU. But many are having quite a hard time with it, says Blackberry.

In Germany, many companies are not yet fully prepared to comply with the requirements resulting from the second Network and Information Security (NIS 2) directive. At the moment, this does not seem to be a priority for those responsible, as Blackberry notes. This is at least the finding of a current study based on a survey by Coleman Parkes Research among a hundred German IT and cybersecurity decision-makers. Above all, the lack of an overview of the software supply chain is causing a major problem, as it turns out. This affects an estimated 25,000 to 40,000 companies in Germany. It calls for several new or tougher risk management measures. These include, among other things, concepts for risk analysis and for security in information technology. Coping with security incidents and maintaining operations are also included. Depending on the size of the companies, the regulations also vary, which adds further difficulty. Not all would have to ensure the highest level of security. Of the German companies surveyed by Blackberry for the study, 64 percent are subject to the NIS-2 directive. Overall, 54 percent are highly (or very highly) confident that they will be able to meet the requirements by the deadline. In contrast, 33 percent are only modestly confident. About 13 percent believe they will not make it. The federal government today approved a draft law in the cabinet after several attempts, ahead of the approaching deadline for implementation.

Lack of transparency jeopardizes compliance

A major role is played by the software supply chain of companies. It not only poses a wide gateway for cybercriminals, but also complicates compliance with the NIS-2 directive. This is related to the strict obligation to report security incidents. After the discovery of a significant and successful cyberattack, companies must inform the Federal Office for Information Security (BSI) within 24 hours. However, they often only learn about incidents in their own software supply chain late, according to Blackberry's experience. Only 32 percent demand to hear from the affected partners and software suppliers within the first four hours. The other 68 percent expect a notification within a day, or even later. Given this situation, companies are now at risk of violating compliance requirements, which has consequences. In many places, the software supply chain also appears to be a blind spot in the security strategy. Consequently, there is a lack of transparency. It is often unclear who belongs to the software supply chain. Thus, last year, 79 percent of companies were made aware of a member that was previously unknown or whose security measures they had not monitored until then.