NIS2 for manufacturing organizations: 3 steps in the direction of compliance

October 17 is rapidly approaching… that is when your group is anticipated to adjust to the European NIS2 Directive. You would possibly really feel you continue to have time, or that there will probably be extra delays, however in truth, it’s time to kick begin your compliance journey into excessive gear and guarantee your manufacturing group is in control.

What’s NIS2 directive?

Community and Data Safety (NIS2) Directive, the brand new iteration of European Union’s NIS, elevates the stakes even greater with stricter cybersecurity necessities, incident reporting pointers, and vital monetary penalties for non-compliance. NIS2 makes compliance obligatory for all organizations with revenues over €10 million, so that you’re in all probability impacted.

(Learn this weblog for extra particulars: “NIS2 compliance for industrial networks: Are you prepared?“)

Navigating NIS2 compliance may be difficult, however it serves the better good because it helps improve your group’s digital safety, and bolsters the EU’s collective cyber resilience, enabling a united entrance towards potential cyber threats for the advantage of all.

In line with IBM, the manufacturing business noticed the very best share of cyberattacks amongst any business worldwide in 2023. Perhaps you suppose your organization will not be a goal of cyber assaults? Maybe you suppose you’ll by no means be audited for NIS2 compliance? Make no mistake: any group may be hit by malware, and your nation’s cybersecurity company will implement NIS2 as a excessive precedence.

NIS2 tremendously improves your skill to guard towards threats, domesticate belief inside your group and stakeholders, and safeguard operations to guard your online business. Most NIS2 measures are fairly easy and thought of as obligatory greatest practices no matter any regulation. They’re key to bettering your group’s resilience and guaranteeing the success of your manufacturing operations.

What must you do to get began?

Strengthen your manufacturing unit safety and drive NIS2 compliance with the next 3 steps.

1. NIS2 recommends a risk-based method to cybersecurity which requires complete visibility into the OT atmosphere.

You want an in depth stock of all belongings linked to your manufacturing unit community, their vulnerabilities, their communication patterns, and extra to successfully assess OT cyber dangers.

Cisco Cyber Imaginative and prescient mechanically detects and profiles linked belongings and displays communications actions to detect malicious site visitors and anomalous behaviors. It scores dangers to assist groups prioritize what adjustments and mitigations will probably be most impactful for bettering the OT safety posture. It’s constructed into switches and routers so it’s straightforward to deploy at scale with out extra home equipment or community sources. Cyber Imaginative and prescient helps to evaluate OT cyber dangers and supplies a robust basis for getting began with NIS2. Study extra on this answer overview.

2. NIS2 requires implementing superior capabilities comparable to zero-trust entry management insurance policies.

This implies proscribing community communications throughout the manufacturing unit and from outdoors the manufacturing unit except they’re particularly approved to run the economic course of. This may be greatest achieved by way of two measures.

Section the manufacturing unit networks to keep away from malicious site visitors to simply unfold and compromise your operation. As a substitute of deploying expensive zone-based firewalls all through your factories, use Cyber Imaginative and prescient to logically group belongings into zones of belief. Cisco Identification Companies Engine (ISE) or Cisco Safe Firewall can leverage this info to implement insurance policies proscribing communications between zones, therefore segmenting the economic community with out complicated {hardware} and cabling modifications.

Take management over distant entry to OT belongings. Distributors and contractors must remotely entry industrial belongings for upkeep and troubleshooting. However how do you make it easy to regulate who can entry what, when, and the way? Cisco Safe Tools Entry (SEA) is particularly designed for OT workflows, enabling extremely granular zero-trust community entry (ZTNA) insurance policies comparable to which belongings may be accessed, by whom, at what instances, and utilizing which protocols. It’s easier to deploy than legacy VPNs and makes it straightforward for OT staff to handle their distant entry wants whereas complying with safety insurance policies.

3. NIS2 makes it a authorized obligation to report cyber incidents inside 72 hours.

Not solely does this imply you want instruments to detect them, you additionally want a platform to handle them. Cyber Imaginative and prescient combines protocol evaluation, intrusion detection, and habits evaluation to detect malicious actions in your manufacturing unit community. Occasions are aggregated into Cisco XDR and/or the Cisco Splunk safety platform, making detection, investigation, and remediation easier and extra highly effective by unifying cyber safety throughout IT and OT.

Benefiting from ISA/IEC 62443 to adjust to NIS2

NIS2 emphasizes the usage of worldwide requirements to make sure that entities inside its scope implement efficient cyber risk-management measures. Implementing the ISA/IEC-62443 industrial cybersecurity framework goes a good distance in the direction of NIS2 compliance, because it consists of most necessities comparable to threat evaluation, entry management, robust authentication, use of cryptography, steady monitoring, enterprise continuity and catastrophe restoration, and extra. So, in case your group is already implementing the ISA/IEC-62443 cybersecurity framework (particularly elements 2-1, 3-2, and 3-3), you may be effectively in your strategy to addressing most of NIS2 necessities.

NIS2 compliance is a journey and alter doesn’t occur in a single day. Let Cisco information you step-by-step with an infographic that has all of the sources you have to get your compliance journey began: 4 Steps to Put together Your OT for NIS2

Be part of us for a webinar on how Cisco and Splunk might help with NIS2 compliance:

27 June 2024  |  2pm CET

Extra sources

Share: