TFL Vsebine / Revija SIR*IUS

Directive (EU) 2022/2555 on measures for a high common level of cybersecurity – NIS 2 Directive and the upcoming new Information Security Act – what internal auditors and information system auditors need to know

Konec leta 2022 sta Evropski parlament in Svet sprejela dve direktivi za zaščito t. i. kritičnih subjektov – organizacij, ki so ključne za vzdrževanje pomembnih družbenih funkcij, gospodarskih dejavnosti, javnega zdravja, varnosti in okolja. To sta Direktiva (EU) 2022/2555 – NIS 2, ki je osredotočena na doseganje visoke ravni kibernetske varnosti po celotni Evropski uniji, in Direktiva (EU) 2022/2557 – CER, ki krepi odpornost kritičnih subjektov na vseh drugih področjih. Ob pripravi tega prispevka je že v javni obravnavi tudi osnutek novega, na NIS 2 temelječega Zakona o informacijski varnosti (v nadaljevanju: ZInfV-1), ki bo zahteve direktive NIS 2 prenesel v slovensko okolje. Osnutek ZInfV-1 in direktiva NIS 2 razširjata obseg ukrepov za kibernetsko odpornost na več sektorjev, uvajata strožje zahteve za obvladovanje tveganj in poročanje o incidentih ter predvidevata višje kazni za kršitve. Ker je v času priprave prispevka novi ZInfv-1 šele v fazi osnutka, gre pričakovati, da se bodo nekatere določbe, ki jih predstavljamo, še spremenile. Ker pa je časa za prilagoditev zavezancev zahtevam NIS 2 zelo malo, je ključno, da čim prej začnejo ocenjevati vrzeli svojih obstoječih postopkov glede na zahteve novih predpisov s predpostavko, da se ZInfV-1 v končni objavi ne bo pomembno spremenil. Notranji revizorji in predvsem revizorji informacijskih sistemov imajo ključno vlogo pri podpiranju organizacij z oceno upravljanja tveganj kibernetske varnosti, preverjanjem pripravljenosti na nove zahteve oziroma skladnosti z osnutkom ZInfV- 1 in direktivo NIS 2 ter priporočanjem ukrepov za izboljšanje kibernetske odpornosti.

At the end of 2022, the European Parliament and the Council adopted two directives for the protection of so-called critical entities— organizations that are essential for maintaining important social functions, economic activities, public health, safety, and the environment. These are Directive (EU) 2022/2555 – NIS 2, which is focused on achieving a high level of cybersecurity throughout the European Union, and Directive (EU) 2022/2557 – CER, which strengthens the resilience of critical entities in all other areas. During the preparation of this article, a draft of a new law based on NIS 2, the Information Security Act (hereinafter: ZInfV-1), which will implement the requirements of the NIS 2 directive into the Slovenian environment, is already under public review. The draft ZInfV-1 and Directive NIS 2 expand the scope of measures for cyber resilience across multiple sectors, introduce stricter requirements for risk management and incident reporting, and envisage higher penalties for violations. Since the new ZInfv-1 is only in the draft stage at the time of writing this article, it can be expected that some of the provisions we present will still change. However, since there is very little time for entities to adjust to the requirements of NIS 2, it is crucial that they begin as soon as possible with gap assessments of their existing procedures against the requirements of the new regulations, assuming that ZInfV-1 will not change significantly in its final publication. Internal auditors and above all information system auditors play a crucial role in supporting organizations by assessing cyber risk management, verifying readiness for new requirements or compliance with the draft ZInfV-1 and NIS 2 Directive, and recommending improvements for enhancing cyber resilience.