01/07/2024
๐ Why your organisation canโt afford to ignore new EU cybersecurity laws
NIS2 becomes law in October 2024, and compliance will be mandatory for organisations that meet or exceed a specific size and/or turnover threshold. Those that donโt reach the Directiveโs cyber risk management and incident reporting standards โ among other requirements โ could face potentially punitive fines. Thatโs why Irish businesses should be asking themselves: will this new legislation apply to us? If it does, are we ready for it?
David Curtin, CEO of .ie โ the trusted national registry for over 330,000 .ie domain names โ is concerned that they might not be prepared. โNIS2 is an update of NIS1, the previous EU cybersecurity directive,โ he explains. โWhile NIS1 only applied to around 100 Irish companies, approximately 3,000 Irish entities will have to comply with the new legislation, according to the NCSC.โ
Another difference is that only seven sectors were affected by NIS1 (including healthcare, energy and transport); but NIS2 will cover 15 sectors (including manufacturing, digital providers and food production). โPlus, this time around, the supervisory regime will be strictly enforced, and failure to report breaches will be harshly punished,โ warns Curtin. The maximum fine for violations is โฌ10,000,000 or 2% of global yearly revenue โ whichever is higher.
The new legislation poses challenges from a regulatory enforcement standpoint, he admits. โTo be able to do their jobs properly, regulators will need to be fully resourced with the right staff and facilities,โ says Curtin. โThis will take time, which is fast running out.โ
https://lnkd.in/eiFqVvgy