NIS2 is top of mind in many boardrooms, and it applies to thousands of organizations equally, although some implementation efforts may be more equal than others. In that context, we thought it would be valuable to take a closer look at some of the\u00a0classic pitfalls\u00a0we\u2019ve observed based on our experience working closely with CISOs from a wide range of organizations.<\/p>\n
Spoiler alert: cybersecurity doesn’t happen in a vacuum. It\u2019s one of those fields (much like privacy) that affects not just one department in an organisation. Whether it\u2019s IT, legal, procurement, leadership, you name it, if these players aren\u2019t on the same page your project risks becoming a game of Chinese Whispers (no, that\u2019s not a Chinese APT reference although it does admittedly sound more mysterious than Salt Typhoon or Deep Panda). In short, communication matters. Reporting, progress reports, alignment, all crucial elements in a successful NIS2 project.<\/p>\n
Keep in mind though, NIS2 isn\u2019t just an internal party. Everyone is invited, especially third-party suppliers. And boy, do they love to dance, especially when they become an attack vector for your organisation. Many organizations outsource critical IT or cloud services but fail to recognize how deeply those vendors are embedded in their risk landscape. That\u2019s a big blind spot.<\/p>\n
Vendors often carry a significant chunk of your cyber risk, but they won\u2019t naturally align with your goals unless you\u00a0bring them to the table early and set clear expectations.<\/p>\n
Bottom line:<\/strong>\u00a0keep the communication lines open, loop in the right people early, and don\u2019t forget this also includes crucial external partners.<\/p>\n One of the biggest mistakes organizations make? Treating NIS2 like a technical problem to be solved by IT alone, or on the other end of the spectrum: a paper tiger on the hunt for documentation and risk assessments that need to be tackled by legal and compliance.<\/p>\n In reality, NIS2 demands\u00a0a top-down, organization-wide approach to security governance. If you treat it like \u201cjust another certification\u201d or a box to tick, you\u2019ll end up drowning in paperwork with little to show for it. A Cyfancy framework does not make a governance program!<\/p>\n Instead, focus on building a pragmatic but functional governance program or ISMS\u00a0(Information Security Management System). Translation: a program that does tick all the compliance boxes, but more importantly: one that actually works for your organisation and is embedded in daily operations, decision-making, and company culture.<\/p>\n Inconvenient truth: cybersecurity takes\u00a0the right people, the right skills, and the time to do things properly. Regardless of the inescapable paper trail: the spirit of NIS2 legislation is higher levels of cyber resilience and to achieve this there are no shortcuts.<\/p>\n Too often, projects are launched with existing staff who already have full plates. Cybersecurity is anything but boring which means staff has plenty of work as is.<\/p>\n To set your organisation up for a successful NIS2 implementation, you need:<\/p>\n Skimping on resources is a short-term solution, in the long run this results in the worst of both worlds: extra work with little to show for it in terms of actual cyber resilience.<\/p>\n If you\u2019re investing months (or years) of effort into NIS2, you should know what you want to end up with. NIS2 compliance, much like GDPR compliance, is not an objective itself.<\/p>\n Too many teams launch into large projects without ever asking what success looks like. How will you know if you\u2019re making progress? What does \u201csuccess\u201d look like in practical terms?<\/p>\n Anyone look at recent Generative AI projects recently? Without clear goals and metrics, we can all pass shoulder pats around the team and feel good, but we don\u2019t know what\u2019s working and what\u2019s not. Perhaps more important, you\u2019ll struggle to justify the investment to leadership and in the end that\u2019s what it often boils down to: what is the return on investment?<\/p>\n Try to define\u00a0measurable, meaningful objectives\u00a0up front. Not just to pass the audit, but to actually get better at what matters: protecting your organization. Think average time to resolve an incident, mean detection time, percentage of critical vendors that were subject to a security review this year, percentage of applications that were part of an access review, etc.<\/p>\n While there are many potential pitfalls, let\u2019s summarise the pitfalls we talked about in this article with some management friendly catch phrases:<\/p>\n <\/p>\n NIS2 is top of mind in many boardrooms, and it applies to thousands of organizations equally, although some implementation efforts may be more equal than others. In that context, we thought it would be valuable to take a closer look at some of the\u00a0classic pitfalls\u00a0we\u2019ve observed based on our experience working closely with CISOs from […]<\/p>\n","protected":false},"author":45,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[619],"tags":[],"class_list":["post-17755","post","type-post","status-publish","format-standard","hentry","category-ciso"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.dp-institute.eu\/en\/wp-json\/wp\/v2\/posts\/17755","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dp-institute.eu\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dp-institute.eu\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dp-institute.eu\/en\/wp-json\/wp\/v2\/users\/45"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dp-institute.eu\/en\/wp-json\/wp\/v2\/comments?post=17755"}],"version-history":[{"count":4,"href":"https:\/\/www.dp-institute.eu\/en\/wp-json\/wp\/v2\/posts\/17755\/revisions"}],"predecessor-version":[{"id":17877,"href":"https:\/\/www.dp-institute.eu\/en\/wp-json\/wp\/v2\/posts\/17755\/revisions\/17877"}],"wp:attachment":[{"href":"https:\/\/www.dp-institute.eu\/en\/wp-json\/wp\/v2\/media?parent=17755"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dp-institute.eu\/en\/wp-json\/wp\/v2\/categories?post=17755"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dp-institute.eu\/en\/wp-json\/wp\/v2\/tags?post=17755"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}2. Just Going Through the Motions<\/strong><\/h2>\n
3. Underestimating the Resources You\u2019ll Need<\/strong><\/h2>\n
\n
4. What Does Success Even Look Like?<\/strong><\/h2>\n
Management Summary<\/strong><\/h2>\n
\n
Want to learn more about a successful NIS2 implementation? Register for our NIS2 Lead Implementer training<\/a>!<\/h4>\n","protected":false},"excerpt":{"rendered":"