Based on our long experience of developing and securing IT solutions in complex and heavily regulated sectors, NNIT has developed an approach for organizations to reach a compliant state. This works for one piece of legislation (e.g., NIS2), but can be expanded to incorporate multiple sets of regulations. This approach is interdisciplinary; it brings NNIT’s IT, business, and compliance specialists together with your organization to understand the extent to which your organization must be brought into compliance and what needs to be done to reach this state in a pragmatic way.
Cybersecurity
Regulatory Cyber Compliance
Complex cyber compliance made simpler
The volume of EU regulation aimed at reducing cyber threats within the European Union is increasing. The “AI Act” aims to ensure that Europeans can trust what AI has to offer, and the Network & Information Systems 2 Directive (NIS2) seeks to safeguard critical sectors and supply chains, to name a few. Key challenges will be to identify where the cyber regulation applies and implement adequate security measures without overspending on security.
Our Approach
-
Scoping
Identification of the services, processes, and products covered by EU cyber regulation, typically based on your service/product catalog or contractual obligations. Output is a list of the systems or suppliers that must be compliant.
-
Control framework required for compliance
Mapping from regulatory requirements to security controls which can be used to reduce cyber risks. Output is a list linking directives to security controls, as well as a maturity assessment of the ‘as-is’ state of the controls.
-
Gap analysis between ‘as-is’ and compliant ‘to-be’
Analysis of the potential gap between the current security level and the level required for regulatory compliance. Output is a bar chart showing the difference between your current security level and where you need to be if you are to be compliant.
-
Recommendations for what is required for compliance
An overview of what is required for compliance. Output is a table of which ongoing or scheduled future security projects will contribute to compliance, as well as a list and high-level description of new projects or initiatives that NNIT recommends to ensure compliance.
Key benefits and business outcome
- Understanding of which parts of your business are affected by EU cyber regulation.
- Transparency as to which security controls are required for compliance.
- Clarity regarding the possible gap existing between the current security level and a compliant state.
- Opportunity to streamline controls to address multiple regulatory frameworks.
