How to prepare in time to comply
with NIS2-based cybersecurity regulations?
We would like to inform you that companies in certain sectors will be required to take a number of cybersecurity-related steps in the near future under Act XXIII of 2023 on Cybersecurity Certification and Cybersecurity Supervision ("Cybersecurity Act") and the underlying NIS2 Directive and related legislation. This is important not only due to the legal compliance, but also because a single successful attack can cause unforeseeable damage to the affected parties.
Self-identification and registration with the SZTFH (Authority for the Supervision of Regulated Activities) must be done by 30 June 2024. Thereafter, compliance with the applicable regulations and specific safeguards will be required from 18 October 2024, a very tight deadline given the complexity of the tasks. There is a supervision fee to be paid to the authority, and in the case of non-compliance very high fine payment should be performed, furthermore the management has a particular responsibility for compliance under the legislation.
Compliance must be audited, with a deadline for contracting an auditor of 31 December 2024 and a deadline for the first audit of 31 December 2025. The list of auditors has not yet been published, but they will clearly not be involved in the preparation and, given the thousands of companies involved, their capacity to audit will be extremely limited. This is why proper preparation is crucial.
Preparing for NIS2 cybersecurity compliance is a complex process that requires both legal and IT expertise. Even for self-identification and registration, a detailed analysis of the company, its public services, relevant technical data, partner data and the designation of an information security officer is required.
Compliance will require, among other things, the identification and classification of electronic information systems (EIR), a GAP analysis, risk analysis, the preparation of an action plan and related documents (IBS, DCP, BRP), staff training and the establishment of supply chain security.
VGD Hungary, together with its cooperating partner, can provide effective assistance throughout the preparation and compliance process. The solutions provided focus on business processes and respond to current global trends, which is not only the result of a carefully built team, but also to the cybersecurity experts.
Should you have any questions or need more information, please do not hesitate to contact our expert colleagues.
This newsletter provides general information and does not constitute advice.
