Our NIS2 working group continues to gather professional experience related to the domestic regulation and its practical application. We continue to welcome comments, suggestions and questions on the NIS2 subpage of our website - even anonymously.<\/p>\n
The domestic introduction of the European Union's NIS2 Directive (2022\/2555\/EU) has brought significant changes to the operations of many organizations. Recent experience shows that many practical questions arise from obligated organizations, consultants, information security officers and auditors regarding implementation, audits, identification of EIRs and definition of the scope of stakeholders.<\/p>\n
Our NIS2 working group was established with the aim of collecting, systematizing and forwarding this experience to the legislative side. Our aim is to establish a broader professional dialogue that will allow the necessary modifications and clarifications to be made based on professional consensus.<\/p>\n
<\/p>\n
The subpage already contains a number of substantive comments. The submitters suggest, among other things, a phased, maturity-based introduction of requirements, a simplified requirements system for smaller organizations, and the development of separate OT\/ICS, cloud security, and AI security methodologies. Recurring themes include the lack of uniform regulatory guidelines and evidence catalogs, the distorting effects of the audit fee system, the scarcity of auditor capacity, and the risk that compliance becomes too document-centric at the expense of real, operational cybersecurity capabilities. Several suggestions also emphasize the importance of strengthening leadership responsibility and education, as well as a predictable regulatory environment.<\/p>\n
Thank you to all the submitters so far for sharing their experiences with us!<\/p>\n