How can a managing director check that cyber measures actually work?
By asking for tests and results rather than descriptions. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. itself lists policies and procedures to assess the effectiveness of the measures among the required areas (Article 21(2)(f)). Useful checks that need no technical knowledge: ask IT to restore a real system from backup and report the time it took; ask for the share of accounts with multi-factor authentication and the list of exceptions; ask for the date of the last external penetration test and which findings are still open; ask which network segments are monitored and to see one recent alert and what was done about it; and run a short tabletop exercise once a year. Compare the answers quarter by quarter. NetSenX gives you the detection part in plain language: alert history, the list of monitored segments and an audit log of decisions.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Does NetSenX cover all NIS2 Article 21 measures?
- Does buying a security tool make us NIS2 compliant or registered?
- Which NIS2 tasks can software help with, and which can it not?
- Does NIS2 require a specific security tool, such as intrusion detection?
- What happens if we grow or acquire a company and cross the NIS2 size threshold?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.