Focusing on Critical Infrastructure Security

The NIS2 Directive focuses on addressing gaps and strengthening the security of network and information systems across the European Union. NIS2 mandates rapid incident reporting and holds senior management accountable for cybersecurity, shifting responsibilities to the board level. Organizations may be required to comply with it by October 2024.

See Also: NHS Ransomware Attack: Healthcare Industry Infrastructures Are Critical

“The most aggressive timeline that I’ve seen is the 24-hour incident reporting requirement,” said Avani Desai, CEO of Schellman. “This places a huge burden on organizations to have robust detection and reporting mechanisms in place, especially for smaller companies in newly covered sectors.”

Desai advises organizations to conduct a comprehensive risk assessment of their current cybersecurity practices and ensure their incident detection and reporting systems are prepared. “Compliance really needs to begin with doing a comprehensive assessment,” she said. She also stressed the importance of integrating cybersecurity into governance structures and recommended appointing an EU representative for cross-border companies to meet regional regulations.

In this video interview with Information Security Media Group, Desai discussed:

• The major changes the NIS2 Directive will bring to the cybersecurity landscape, especially for organizations in critical sectors across the EU;
• Challenges companies face in preparing for NIS2, particularly with rapid incident detection, reporting and supply chain security;
• Essential steps E.U. and U.S. organizations must take now to ensure compliance.

Desai leads Schellman, the largest niche cybersecurity assessment firm in the world that focuses on technology assessments. She has domestic and international experience in information security, operations, P&L, oversight and marketing involving both startup and growth organizations. Desai has been featured in Forbes, CIO.com and The Wall Street Journal and speaks on a variety of emerging topics, including security, privacy, information security, future technology trends and the expansion of young women involved in technology.