Cyber-resilience dovetails with AI readiness
Just 13% of attendees at a William Fry seminar are very confident in their vendors' and suppliers' cyber-security practices.
The event, ‘Navigating NIS2: Requirements, Best Practices and Practical Insights’ (5 March), heard that cyber-criminals were increasingly targeting supply chains to exploit vulnerabilities in third-party vendors, affecting multiple organisations through a single compromised supplier.
The NIS2 Directive is the EU-wide legislation on cyber-security, which updates the 2016 NIS Directive.
The National Cybersecurity Centre of Ireland has reported that in 2023, of the more than 5,000 incident reports it received, over 700 were confirmed as cyber-security incidents.
The rise of artificial intelligence (AI) and machine learning (ML) presented both opportunities and challenges for cybersecurity, attendees heard.
The seminar provided an overview of the NIS2 Directive, and featured a panel of cyber-security experts, chaired by Susan Walsh (consultant in William Fry's Technology department) and including Rachel Hayes of WF, David Keddy, (Microsoft) and Joseph Stevens (National Cyber Security Centre).
- 28% of attendees polled believed their organisation's board was very actively involved in cyber-security and NIS2 compliance,
- 60% of those surveyed said that their organisation had a fully implemented cybersecurity governance framework in place,
- 24% of respondents' organisations provide monthly cyber-security risk assessments, while 36% conduct risk assessments quarterly and 20% only provide risk assessments after an incident occurs,
- 26% of respondents reported that their IT/cyber-security teams led their NIS2 compliance programme, while 44% were led by legal/compliance teams.
"The NIS2 Directive represents a significant step forward in harmonising cyber-security measures across the EU. It is crucial for organisations to understand their responsibilities and take proactive steps to enhance their cybersecurity posture," said Susan Walsh.
Significant shift
Joseph Stevens said that the directive represented a significant shift in the national approach to cyber-security, demanding a higher level of resilience across critical sectors.
David Keddy said: "NIS2 is a significant step forward in enhancing the resilience of the services people rely on in their daily lives … a secondary effect is that the steps needed to prepare for NIS2 are the same steps needed to deliver on the AI promise over the coming years."