NIS 2 implementation

If you want the full and detailed overview with stakeholders and outputs from the individual phases, you can click here . The overview will be sent automatically within a few minutes.

The individual steps

Implementation

The management plays a large and central role in a successful implementation and subsequent operation of NIS 2. It is therefore essential that the management knows thoroughly about NIS 2, gets a deep insight into roles, responsibilities and the ongoing work in the organization – even after NIS 2 is implemented.

Unitas offers a focused management introduction to NIS 2 for the executive board, board of directors and other relevant top management. You must put approx. 3 hours to it. This is where it all starts!

The next step in the process continues with a workshop , where we together identify the challenges and barriers that must be overcome on the path to compliance with NIS 2. We establish a common understanding of management's responsibilities in relation to NIS 2 and prepare a management report that contains an overall plan for the rest of the process.

We then perform a gap analysis . We use the CIS Controls framework. CIS Controls measures your maturity in relation to 18 technical measures, all of which aim – like NIS 2 – to reduce your cyber and information security risk. Since many of the 18 measures overlap with the requirements that NIS 2 places on you, you will be able to get a good indication of where you are right now and the milestones that need to be met along the way. However, we naturally take as a starting point what relevant documentation you may already have, just as any recently conducted CIS Controls measurement or equivalent can be reused to a greater or lesser extent.

A central part of the implementation of NIS 2 is to create the framework for cyber and information security efforts. Based on an overall cyber security strategy that is anchored in top management, we translate the strategy into an information security policy based on ISO27001, which is in turn anchored in management. On this basis, an overview is prepared of the measures from ISO27002 that already exist and that either need to be improved or established in the organization for the first time in order to comply with NIS 2.

The improvement and/or establishment of the measures is based on risk assessments and, more practically, by preparing subject-specific policies . These policies should be seen as management's order to the rest of the organization to follow the policies to ensure the exact level of cyber and information security that management has set in the cybersecurity strategy and information security policy, and that the risk assessments have shown is necessary. However, the policies can also be called standards, guidelines, directives or handbooks , as we have called them below, depending on your way of communicating.

The policies may cover, for example, access management, physical and environmental security, asset management, network security and backup and must typically be complied with by the IT department in particular, both internally and in relation to IT suppliers, some of whom will also be your data processors.

We then describe the requirements more simply and understandably in an easy-to-read employee-oriented handbook that covers specific areas related to the individual work functions in the organization. Depending on the circumstances, more targeted handbooks can be prepared , for example, for Purchasing, HR and Facility.

Documentation is crucial for compliance! Once the above is in place, you have established a so-called information security management system (ISMS). This is the formally correct name in an ISO27001 context. ISMS means – cut to the chase – that management takes responsibility for and manages your cyber and information security efforts, which management must do according to NIS 2.

Operation of ISMS in an annual cycle: Since the ISMS must be revised and improved based on ongoing risk assessments and perhaps certified, it is of no use for the ISMS to be lying around in Word and Excel files. It must be collected in an ISMS-supporting IT system (GRC system) – that is, in an IT solution. If you already have an IT solution, we will naturally take that as a starting point.

If you have not already chosen an IT Solution, we will help you identify your IT support needs. We have tools such as Wired Relations and Cyberday available to help you with this task. In addition to NIS 2, most GRC systems can also document compliance with other regulations, including, but not limited to, GDPR, PCI DSS, customer specific needs, sector legislation, etc.

Operation and improvement

When the documentation is in place in the IT solution, the organization must comply with policies, handbooks, risk assessments on an ongoing basis, etc. Quite often compliance will mean that you must change your normal activities and work routines. At this stage, there may be a need for a culture change so that the ISMS does not simply end up in the drawer, and you become vulnerable to cyber attacks and possible supervisory reactions, including fines for the organization and the management members.

Examples: It appears from the updated procurement policy that Procurement must ensure that cyber and information security is included as an element in all IT contracts, and that it must be checked that IT suppliers actually comply with the security requirements. If Procurement is not already working with a cyber and information security track today due to lack of resources, it is clear that the updated procurement policy means that Procurement must adjust some of its processes slightly.

It may also be that your passwords need to be improved in light of your new password policy. Again, it may be that a behavior needs to be adjusted.

The adjustment of your daily activities across the organization is called the operations phase . As mentioned, in the operations phase, the measures selected in policies, manuals, etc. are implemented. The goal is to improve the implementation of the measures based on risk assessments. Therefore, any identified non-implemented measures or new risks that need to be handled are naturally acted upon by assessing what is hindering implementation and, if necessary, revising the policy that describes what needs to be done. Finally, it is ensured that the policies have been properly communicated to the right people in the organization.

We can handle the operational phase for you , so you don't have to pay the cost of a GRC function, and you can be sure that the organization contributes to NIS 2 compliance, and that management continuously receives the statutory reporting on your cyber and information security efforts. See more below.

You are on target!

After a successful operational period, you will be able to document compliance with NIS 2 requirements, as well as adjust how you comply with NIS 2 when Danish NIS 2 legislation is in place.

If desired, compliance can be demonstrated by obtaining the D-mark . However, the D-mark is not a guarantee that the authorities also believe that you are fully compliant with NIS 2, but merely an indication thereof. If the ambition is greater than that, or you want to be ISO27001 certified, we will organize the documentation accordingly, so that ISO27001 certification is possible.

So what now – who and how will our NIS 2 be operated going forward?

After implementation comes operation as usual. Here you can Unitas either equip internal employees to take care of the year's wheel's operational tasks, including management reporting, or you can choose to enter into a compliance-as-a-service agreement with Unitas, where we continuously handle the vast majority of NIS 2 tasks. This saves on expensive hiring, which has historically been difficult to retain.