European States Spin Wheels on Cybersecurity Directive

Alex van der Wolk recently spoke to Bank Info Security, a platform that provides up-to-date news on risk management, fraud and compliance for financial institutions, about trends relating to EU member states implementation of the Network and Information Security 2 Directive (NIS2), and which states have harmonized their approach to NIS2, and which have diverged.

According to Alex, "You see a pretty decent baseline of harmonization," in countries’ interpretations of the directive, and "the deviations are in the details.".

For example, as Alex suggested, within the article “the headcount threshold for falling under NIS2’s requirements is another point of divergence - some countries, such as Germany, have chosen to only take the headcount of a company’s local entity into account, while others opt to focus on the company’s overall EU group headcount.”

Further, in Belgium guidance specifies that when a group’s internal IT services are provided by a separate company within that group, that company could distinctly fall under NIS2’s requirements because it provides managed services, even if they are only internal-facing. Alex noted that "other member states are silent on that.”

Read the full article.