Top Stories
EU governments, lawmakers agree on tougher cybersecurity rules for key sectors
Global Banking & Finance Review®
Company
By Foo Yun Chee
BRUSSELS (Reuters) – EU countries and lawmakers agreed on Friday to tougher cybersecurity rules for large energy, transport and financial firms, digital providers and medical device makers amid concerns about cyber attacks by state actors and other malicious players.
The European Commission two years ago proposed rules on the cybersecurity of network and information systems called NIS 2 Directive, in effect expanding the scope of the current rule known as NIS Directive.
The new rules cover all medium and large companies in essential sectors – energy, transport, banking, financial market infrastructure, health, vaccines and medical devices, drinking water, waste water, digital infrastructure, public administration and space.
All medium and large firms in postal and courier services, waste management, chemicals, food manufacturing, medical devices, computers and electronics, machinery equipment, motor vehicles, and digital providers such as online market places, online search engines, and social networking service platforms will also fall under the rules.
The companies are required to assess their cybersecurity risk, notify authorities and take technical and organisational measures to counter the risks, with fines up to 2% of global turnover for non-compliance.
EU countries and EU cybersecurity agency ENISA could also assess the risks of critical supply chains under the rules.
“Cyber threats have become bolder and more complex. It was imperative to adapt our security framework to the new realities and to make sure our citizens and infrastructures are protected,” EU industry chief Thierry Breton said in a statement.
(Reporting by Foo Yun Chee; Editing by Mark Potter)
Cybersecurity refers to the practice of protecting systems, networks, and programs from digital attacks. These attacks typically aim to access, change, or destroy sensitive information, or to disrupt normal business operations.
The NIS Directive is a European Union directive aimed at achieving a high common level of network and information security across the EU. It sets security and incident reporting requirements for essential services and digital service providers.
A cybersecurity risk assessment is a process used to identify, evaluate, and prioritize risks to an organization's information systems. It helps organizations understand their vulnerabilities and implement measures to mitigate potential threats.
Technical and organizational measures are strategies and controls implemented by organizations to protect their information systems and data. These can include security protocols, employee training, and incident response plans.
Explore more articles in the Top Stories category
