Background
We advise our clients to understand how the following regulations/directives apply to them:
- Network & Information Systems Directive (NIS) (UK/EU)
- Network & Information Systems Directive (NIS2) (EU)
- EU Cyber Resilience Act (CRA) (EU)
- EU Medical Device Regulations (MDR) (EU)
- Medical Device Directive (UK)
- DCB0129/0160 (UK Healthcare)
The clauses within these regulations/directives can be addressed in most cases through the implementation of a combination of different ISO standards within a business.
NIS & NIS2
NIS requires organisations to address topics including:
- Information security risk analysis
- Incident response and management
- Business continuity
- Monitoring, auditing and testing
- Compliance with international standards
- System life cycle management
- Supply chain security
NIS2 which is live from 2024 in the EU not only expands the scope of security requirements it increases the number of entities classified as 'Essential' or 'Important' now including:
- Managed Service / Managed Security Service Providers
- Data centre service providers
- Cloud computing service providers
- Medical device manufacturers
- Reference laboratories
- Research organisations
- Manufacturers
Both EU NIS2 and CRA are likely to have major elements transferred into UK law through the UK Cybersecurity and Resilience Bill.
EU Cyber Resilience Act (CRA)
The EU CRA is a complementary regulation to NIS2 but focuses on products instead of businesses. The following product types will now need to demonstrate evidence of the implementation of significant security policies, processes, controls and documentation to receive CE marking:
- Anti-malware software
- Firewalls
- Intrusion Detection / Intrusion Prevention Systems
- Identity managements systems (inc. biometrics)
- Network management systems
- Switches, modems and routers
- Security Information and Event Management (SIEM) systems
- Hypervisors
- Physical and virtual network interfaces
Non-compliance will lead to similar fines to NIS2 and a lack of CE certification which is essential for market access in the EU. Compliance can be addressed through a combination of ISO standards including ISO27001 as a foundation.