NIS and Cybersecurity

The regulations in question impose on Operators of Essential Services in the energy, transport, banking and healthcare sectors, as well as Digital Service Providers operating in the online market and cloud services, the obligation to adopt appropriate technical and organizational measures, otherwise there will be penalties of up to 500,000 euros.

The measures must be identified through a risk assessment process and include organisational solutions (e.g. adoption of an organisational cybersecurity model, risk analysis and incident reporting procedures, adequate staff training, etc.) and technical solutions (e.g. IT/OT systems, SCADA-Supervisory Control and Data Acquisition or DCS-Distributed Control Systems). 

The legislator's intention is to define a culture of corporate accountability, through a process aimed at adopting measures that are no longer standard, but risk approached, for a better protection of assets and its networks and information systems, data and company secrets, to the benefit of corporate welfare.