The new European directive on cyber security, known as NIS2, introduces significant changes compared to the previous NIS directive, expanding the range of organizations involved and assigning specific responsibilities to company leaders. CEOs, CIOs and CISOs are directly involved, with relevant implications both from a legal and organizational point of view.

The main novelties of the NIS2 Directive

NIS2 significantly extends its scope, involving new key sectors such as food production, chemicals, pharmaceuticals, postal and digital services, waste management and even manufacturing. This expansion implies more stringent obligations, including careful management of network and information systems security and a faster and more effective response capacity in the event of cyber incidents.

Direct responsibilities for CEO, CIO and CISO

One of the most significant aspects introduced by the NIS2 directive is the direct involvement of company management:

- CEO (Chief Executive Officer): must ensure that the organization implements an effective cyber risk management system, approving and supervising cybersecurity policies. Furthermore, he must ensure that cybersecurity is integrated into the overall corporate strategy.

- CIO (Chief Information Officer): is responsible for supervising the company's IT infrastructure, ensuring the application and effectiveness of the cybersecurity measures adopted, as well as constantly monitoring the resilience of company systems.

- CISO (Chief Information Security Officer): becomes an even more crucial figure, with direct operational responsibilities in defining, implementing and updating cybersecurity policies. The CISO must also ensure a clear and rapid process for reporting cyber incidents to the competent authorities.

Legal implications and risks for management

The NIS2 directive sets out clear and measurable obligations for management, with direct responsibilities that can result in significant fines and criminal penalties. In the event of non-compliance, companies risk fines of up to €10 million or 2% of annual worldwide turnover, whichever is higher. These aspects place company management in a delicate position, requiring constant attention and timely strategic decisions.

Practical tips for proactively managing NIS2 responsibilities

To effectively address the challenges posed by the NIS2 directive, company leaders should adopt some key strategies:

1. Continuous training and awareness: Implement regular cybersecurity training and refresher programs, ensuring that staff at all levels, especially management, are informed about the latest risks and trends.

2. Periodic assessment of IT risks: Conduct regular vulnerability assessments, directly involving the CEO, CIO and CISO, in order to have a complete and updated view of the corporate risk landscape.

3. Updated Incident Response Plan: Prepare and regularly update a cyber incident response plan, testing it with practical simulations to ensure rapid and effective response.

4. Specific training for management: Offer company leaders specific training sessions on NIS2, highlighting personal and company risks, as well as tools and strategies to proactively address them.

5. Collaboration with experts and authorities: Establish partnerships and open dialogue with cybersecurity consultants and relevant authorities to ensure continuous compliance, timely updates and appropriate incident responses.

Conclusions

The NIS2 directive brings a new awareness and responsibility to the management of cybersecurity at the top level. CEOs, CIOs and CISOs must be prepared not only to comply with regulatory obligations but to transform these obligations into strategic opportunities to strengthen security, corporate reputation and operational resilience.