GDPR keeping you up? There’s another monster hiding under the bed…

Everyone in the security world is talking about the EU’s General Data Protection Regulation (GDPR), and rightly so. GDPR is almost in full force, supplanting the older (and some will argue, out of date) EU Data Protection Directive (DPD). I don’t think regular readers of security news need to be reminded of the severity of penalties that the EU can levy against negligent misuse and abuse of EU citizens’ data.

But there’s another deadline in May that needs to be paid heed. While GDPR primarily deals with data and how it is used, the NIS Directive is “the first piece of EU-wide legislation on cybersecurity.” The directive was adopted in July 2016 and the European Parliament gave EU Member States 21 months to adopt the directive into their respective state laws, and another half a year to identify the organizations, both public and private, that must adhere to the directive.

Earlier this week the UK announced how they plan to adopt the NIS Directive and some of the measures organizations must make to ensure compliance with the directive. The NIS Directive was designed to focus on key critical portions of Member States’ information technology infrastructures – sectors like public utilities, power generators, transportation providers, and organizations providing healthcare for the public – all the basic services a nation needs to operate today. The NIS Directive considers each of these sectors as “Operators of Essential Services,” or OESs.

While currently the NIS Directive only applies to the OESs, the UK’s National Cyber Security Centre (NCSC) recommends that everyone should pay the directive heed. It’s clear this new directive was pushed forward after the substantial impact many attacks have had in recent years on public infrastructure and essential utilities. WannaCry’s disproportionate impact on the networks of the National Health Service (NHS) is clearly not being forgotten by the NCSC.