{"id":9017,"date":"2022-06-29T12:21:00","date_gmt":"2022-06-29T10:21:00","guid":{"rendered":"https:\/\/firstlawyers.nl\/nib2-directive-requires-a-high-level-of-security-and-introduction-of-cvd-procedures\/"},"modified":"2024-02-29T12:22:35","modified_gmt":"2024-02-29T11:22:35","slug":"nib2-directive-requires-a-high-level-of-security-and-introduction-of-cvd-procedures","status":"publish","type":"post","link":"https:\/\/firstlawyers.nl\/en\/nib2-directive-requires-a-high-level-of-security-and-introduction-of-cvd-procedures\/","title":{"rendered":"NIB2 directive requires a high level of security and introduction of CVD procedures"},"content":{"rendered":"\n

I know from experience that entrepreneurs who have become acquainted with cyber criminals often felt powerless because they lost control of their business. They understand better than anyone how important cybersecurity is for the continuity of their business. The NIB2 directive, on which the EU member states and the European Parliament reached a political agreement last Wednesday, June 22, was therefore not primarily written for them. The NIB2 guideline was written for those who still assume that cyber criminals will pass by their door and is intended as a stick behind the door to ensure a high level of security in chains and sectors. <\/p>\n\n

The revised Network and Information Security Directive. NIB2 guideline is the successor to the current NIB guideline, which mandates a high level of security for providers of essential services and digital parties and includes a reporting obligation for cyber incidents. The high level of security and the obligation to report cyber incidents will continue to be maintained. <\/p>\n\n

What is changing?<\/h2>\n\n

Expansion of application range<\/h3>\n\n

The number of sectors that will fall under the NIB2 directive will be significantly expanded. There is a new classification of categories of companies, namely companies that offer essential services – hereinafter the essential companies – and important companies. The sectors that offer essential services will soon include healthcare and public administration, chemicals and the food and beverage industry. These sectors must prepare for the implementation of the NIB2 directive.<\/p>\n\n

Reporting vulnerabilities and CVD procedures<\/h3>\n\n

There remains a duty to report cyber incidents within 24 hours. That is a reactive measure. However, the revised guideline also pays attention to preventive measures, such as setting up and implementing procedures for reporting vulnerabilities. Reporting vulnerabilities is also called Coordinated Vulnerability Disclosure (CVD). See the CVD policy of First Lawyers<\/a> as an example.<\/p>\n\n

Companies developing ICT systems must establish appropriate procedures to address vulnerabilities when they are discovered. Since vulnerabilities are often discovered and reported by third parties, the manufacturer or provider of ICT products or services must also implement the necessary procedures to receive vulnerability information from third parties. ISO standards (ISO\/IEC 30111 and ISO\/IEC 29417) provide guidance on vulnerability response and vulnerability disclosure. Contracts between companies and IT suppliers must be adjusted accordingly.<\/p>\n\n

Supply chain role<\/h3>\n\n

Essential businesses should further assess and consider the products and cybersecurity practices of their suppliers and service providers for cybersecurity risks. That is also new. They must also exercise care when selecting providers of incident response, penetration testing, security audits and consultancy. After all, they also play an important role in detecting incidents and responding to them. There is a need to effectively organize the legal operations<\/a> that focuses on partner risk management, contracting and contract management.<\/p>\n\n

Other cybersecurity risk management measures<\/h3>\n\n

Not new, but an important task for essential and important companies is that they take appropriate and proportionate technical and organizational measures to manage security risks. The goal is to achieve a high level of security. According to the NIB2 guideline, these measures must at least include:<\/p>\n\n