Comply or Cry:
NIS2: driving pain

Well, let's get started. Firstly, thank you guys for joining. It's always good kind of running these sort of webinar sessions and seeing kind of people's responses and actually interest in governance, so to speak. I love the kind of Comply or Cry series and I think when we were coming out with the name, it definitely rang true with what we have to deal with every day. We absolutely hate compliance regulations and sometimes it drives us absolutely crazy.

So this sort of series I think really helps all of you guys to kind of understand some of the bits that perhaps we don't always have a chance to follow. But this particular episode or webinar is really focused on just the NIS2 directive. So it's EU specific. I think it's quite important to know that cybersecurity directive is essentially what it looks towards. It's been in place for quite a while, but we'll go through that in just a second.

The idea of these in fact every kind of episode or series that we're doing from the Cyber Essentials one and so on is really to give you an idea of what it really is, how it actually impacts you, sort of the minimum security controls that we need to adopt and understand, where that impacts the MSP yourselves specifically, and then also where can inforcer help leverage and support you. And I if you've joined the DORA one that I did I don't know three weeks ago now, at the end of this episode you will be emailed hopefully with a follow-up with a HTML file and an Excel sheet that we've used for assessment checks that I've either used at my former place that we you guys can leverage and the HTML is just a nice clean sheet just to give you an understanding of where the controls and the metrics really resonate for you guys.

So first and foremost, what is NIS2? I think that's always a good place to start. NIS2 is essentially the EU's flagship cybersecurity directive. It's designed to kind of raise the bar across 18 critical sectors, far broader than the original NIS directive it replaces. And it's kind of important if clients operate in energy, transport, health, digital infrastructure, public administration, manufacturing, food, waste, and there's a lot more to go. They're all in scope for this specific kind of regulation that they have to adhere to it.

There's no kind of two ways about it. And that also means that you too, or their ICT provider, are also impacted by NIS2. So if you do support any of those and have any sort of reference, and this includes supply chain specifically as well, you're essentially in scope for this. You're in a position where you could end up being audited as a result and being asked to produce information and regulation information policies and so on and actually evidence.

So I think it's really quite useful to know that's really where we sit and it's actually targeting quite a broad space of kind of industries specifically or industry verticals. And it's focused around cybersecurity. But there's a whole lot more to the NIS2 directive than just specific areas that we're going to talk about today, but I do try and cover most of these where I can. But just to kind of give you exactly a rundown of what it is or the naming.

It's Directive (EU) 2022/2555. It's the EU's updated cybersecurity law replacing the original NIS directive and it's been effective since October 2024. So it's been around for quite a while. And the reason why we're really bringing this up now outside of the fact that my colleague Roy and the team are focused heavily on making sure that we can provide you guys with some sort of benchmark assessments around this, but it's also because now we're actually seeing EU standards being actually registered and specifically targeted.

So we're actually getting to the point where there are businesses that are being asked or being required to produce audits and information or being audited specifically around these regulations. It's established as a unified legal framework. It's designed to strengthen our cybersecurity posture across those sectors. And it really does hit home with ICT providers and that is an MSP. So the areas it's going to cover, both the essential and important entities across the EU economy, it's introducing a size cap rule.

So 50 plus employees are the main target here, or 10 million Euro turnover brings you into this scope. Again, just to clarify, this kind of all of a sudden starts thinking, well actually we're below 50 employees, our turnover perhaps isn't 10 million Euros. This also targets a supply chain that covers across some of these industry sectors. So actually you are still become a target of this if you're manufacturing, let's just say eggs, you're turning over less than 7 million Euros and as in not manufacturing eggs, sorry, producing eggs from chickens.

I should say that correctly. And there's only 10 employees, but you're providing it to another supply chain where the food establishment is 100 million Euro turnover. They're still required to meet NIS2 directive. Very obscure scenario, but I'm sure maybe one person on this call has a company that farms chickens. I don't even know where that one came from. The other area is mandating 10 minimum cyber security risks and I'm going to show you those 10 in just a second and it sits under a measurement called Article 21 and I think it's quite useful to know this because you're actually going to be mainly subjected to Article 21 in terms of those regulations.

But what's interesting is breaching. And it's similar to DORA, slightly harsher I would say to a degree. We're required as a strict incident reporting methodology, 24 hour, 72 and a 30 day timeline and I will show you what that looks like a bit later on. The other area is it's actually changing who's accountable. It's gone from kind of the business specifically being accountable, but actually your senior management personally end up becoming accountable for these cyber security compliance requirements.

So if you are a director in an MSP, you're essentially in a position where this could be held against you specifically. Not saying you will, obviously. We want to make sure we're in NIS2 directive, but we do want to make sure that we are covering ourselves where possible.

So what are those 10 minimum requirements or 10 minimum security measures they look at. First one's risk analysis policies. So access sorry, assess and manage risks across all the information systems that we use. So FYI, that would include things like IT Glue, our PSA integrations if you're using ticketing or documentation types. Incident handling. So we want to be able to It's essentially an EDR, ITDR or XDR based solution where detect, classify and report on security incidents.

Now a lot of us use kind of our PSA integrations to handle those and I definitely would encourage you to do so. But the evidence that we collect from incident handling certainly sits with the AV or the antivirus or identity security or sign in logs that we look at. So there are elements in there that we can be leveraging from Microsoft, unified logging being a good example. Business continuity. So maintaining backups, management, backup management, disaster recovery and crisis management plans.

Now this one's quite a big one. It's mainly or mainly focused I would say around data specifically making sure we have backups of data. But when we talk about backing up SharePoint, OneDrive, user data, mailboxes etc. When we ever have to do a restore, what's the process that we follow? And that's our documentation, that's our business continuity plan, disaster recovery plans. We document really well. But I would actually add to this and think do we and should we be backing up policies as well?

And the answer is probably yes. When we are doing backups for data etc. Where we restoring it to is that's a new Microsoft 365 tenant. The ability to back up those policies obviously is going to become quite invaluable for us. Other areas we've also got is supply chain security. So again this really resonates with you guys as the MSP and good example would be that chicken farm factory that I've randomly brought up. But then being a part of a supply chain for NIS2, we're all part of that requirement.

We all have to adhere to these same 10 minimum security measures. So assess, secure relationships with direct suppliers is also critical. Good example is business to business compliance in 365. Do we have that B to B collaboration? Are we enforcing MFA for guest access? Believe it or not, they are all part of that supply chain security sort of scenario. Again, some of these things are great areas, but it's still things that we should be considering and I think a hard line on adopting this appropriately is a really good shout.

Network security, obviously, secure acquisitions, development and maintenance, you know, network security is a hot topic for most of us. And I know that we are slowly changing that methodology. We don't always have to think about the on prem environment nowadays when we've got modern work in place. Actually, the identity being that new perimeter, specifically Microsoft 365 being that new server. Those sort of elements are actually where our focus should be. And I think network security is an update and it certainly isn't necessarily something we have to think about for modern work.

But generally, you guys as an MSP, I think it's important we know that we're not just looking at modern work when we're talking about NIS2. Effective, effectiveness and assessment, so policies and procedures to evaluate an effectiveness of security measures. This, guys, is certainly the tenant alignment report in inforcer. But it's also the policies that we write down for our customers or our internal policy documentation from acceptable use policies, to backup policies to, handling of documentation for our customers, those sort of policies we need to adopt.

All of those all count towards this. And actually, the tenant alignment report is a really good shout to produce as evidence to your customers to say we can categorically say that your policies inside your Microsoft environment meet the security standards we recommend. And that security standard is something that you guys are adopting and producing to your customers. The other one's cryptography and encryption drives me mad, but again, it's policies, for you the use of cryptography, where relevant or encryption.

So this is data at rest essentially. There's a lot more to it, but if you look at the modern place modern workplace specifically, that's BitLocker encryption. That's have we got customer managed keys or is Microsoft managed keys within the modern workplace. So all encryption based requirements. I'm not saying we need customer managed keys, which we know is an E5 license specifically, but what I am pointing out here is endpoint management and endpoint protection. So have we got BitLocker enforced?

Can we produce evidence again to provide that to a an auditor if they were if we were ever approached? Nice easy one I think, HR security and training. We are so good now as an MSP adopting cyber awareness training and programs from KnowBe4 to Meta Compliance and others. If you're using Microsoft specifically, the attack simulation services, all of those functions are available for us to use. It's basic cyber hygiene and we can demonstrate that quite easily with a single sign on the SAML configurations.

My last place we used KnowBe4 quite heavily. Fantastic. I quite like the Inside Man series. Bit of a adopter of that personally. These are things again, measurements that Article 21 forces us to make sure are in place and we need to be able to produce an audit reports on these. Access controls and MFA are a given: it's identity. And the last one's asset management. So maintain an overview of all relevant assets and ensure proper utilization and this one's quite a weird point and I don't know who's read specifically NIS2 but because we're doing this series I've been told I've got to read it in depth.

I find their grey area on this comment quite weird, right? Peripherals, believe it or not, are actually included but they're not really measured. So that was a bit of a strange one. But laptops, servers, network equipment, all those things we need to make sure are asset managed. They also provide a recommendation on their website for a three to four year overturn of hardware and equipment. That again, nowadays is probably more five to seven if you look at it properly with the latest Macs and Windows technology out there.

Actually, we could probably get away with holding laptops and devices for a bit longer than just the three or four that they've recommended.

So NIS2 and 365. Why Microsoft 365 is central to NIS2 is probably most important conversation we should have. And for most of your clients, 365 is the digital workplace. It's our control plane. It's where email, identity, files, collaboration all lives. That makes it directly in scope for a NIS2. Every security configuration needs to be documented, monitored, or audible. So again, unified logging, the ability for us to essentially see somewhat drift detection in terms of changes being made.

It's NIS2 is an encouragement for continuous monitoring of an environment. And the key Microsoft 365 areas are listed on the right. Entra ID for identity, Exchange Online for email security, or Defender for Endpoint at Office, sorry, Intune for device compliance, Defender for threat detection, Purview for data protection, and conditional access for that risk-based control management, which I know sits in Entra. I've deliberately separated this because there are actually specific requirements for risk-based management for that signing in, risky signing controls for NIS2 specifically.

And at that point, we're talking about Entra planning. So it's something to worth kind of being aware of. Something we need to highlight, and we also need to accept as a control measure. So in some respects, we're going to have to go down the route of potentially uplifting some of our customers that do meet these NIS2 requirements, yourselves included. But it's really important to see where we sit with 365 against NIS2 because it's essentially the middle ground.

It's the middle tier area where we focus solely on this one. It's the central point for NIS2 when we talk about all auditing, regulations, and requirements. And the reason for that is really because identity is where everything sits. When we talk about emails or on-prem file servers, the majority of the time, whatever happens, identity sits normally with Microsoft 365 unless using G Suite or another.

So the 365 security controls that map to NIS2. This I think's really useful to see. We've got prevention and protection and detection and response. And there are the four pillars that NIS2 kind of follow. Again, the four pillars pretty much across the board. There's either four or there's six. It really does vary depending on the frameworks that we're following. But prevention and protection starts with conditional access for risk-based authentication, MFA enforcement across all user accounts, data loss prevention policies.

Yes, that's a requirement. Intune device compliance baselines, sensitivity labeling, and encryption policies. And I'm not going to go into a deep dive of this, but the HTML file that I will give you guys towards the end of this will give you a good understanding of what they mean by sensitivity labeling because we all know Purview projects are a pain. BitLocker and device encryption enforcement, all of these are prevention and protection measures that are mapped to NIS2 or can be mapped to NIS2.

We don't have to do specifically sorry, excuse me, security controls in Microsoft. Obviously, I'm on this call to encourage you to do so. And then you've got detection and response. So that's our Defender for Endpoint threat monitoring, unified audit logging in Purview, alert policies and automated investigations. All of these functions are essentially part of that XDR within Defender. EDiscovery for regulatory evidence, believe it or not, we have to have that up and running and working specifically.

Secure score for posture assessment. They do actually reference a specific minimum requirement and for the life of me, I had written it down and I can't find it. There is a certain percentage that we now need to hit. And then incident response playbooks via Sentinel integration. Now this is something that can map to NIS2, guys. I'm not saying all of these controls we have to map for NIS2. Some of this you're going to be using with other audit log information.

Maybe it's to do with your PSA and you're receiving information and audited logs in there. Maybe your secure score for posture assessment is actually measured against something else. For example, inforcer's alignment score as a good example. We're not expecting you guys to do all these controls. However, I have most of this written down for you. So if you did want to follow these controls to map to NIS2, it's certainly going to be a lot easier than finding your own way in terms of hitting those on the head, for example.

I think it's just kind of useful to point that Microsoft 365 is already giving us these tools. The challenge is actually for us enforcing them consistently across every tenant, and at the end of it is proving it. So this is where that continuous monitoring goes on, and it's a pain for us as MSPs because we have hundreds, if not thousands of tenants where sometimes we have to have these NIS2 controls mapped.

So going back briefly to why we're in scope, because I know maybe some of you have already spent the last 5-10 minutes thinking actually we're probably not in scope for this. The reason why we are is NIS2 explicitly classifies MSPs as ICT service management providers under the Annex 1 article, meaning you're directly regulated, not just indirectly through your clients. Even if your MSP is based outside of the EU, if you serve EU clients in NIS2 sectors, what you're in scope.

And just to clarify, that wording has come directly from NIS2, not from myself. Your clients are now legally required to verify that their suppliers, i.e. You, meet NIS2 standards. Supply chain security is one of the 10 measures, so expect questionnaires, audits, and contractual security clauses to become standard. I've never had to read out someone else's statement before. That felt really lame. Anyway, that's just proving the point. We're genuinely having to We're genuinely having to meet these standards ourselves, and that's just proving the point for you guys there.

We're in that clause, we meet that standard if we support anyone within that scope. We means we're in scope specifically. And as the image probably alludes, it can be quite terrifying when we talk about making sure we meet these regulations. And there'll even be some people again on this call who will be thinking well actually the likelihood of us being audited is pretty zero or pretty much zero. And the likelihood of our customers being is also pretty much zero.

And we're probably not wrong by you know the next 10-15 years we're probably only ever going to see maybe six, seven, possibly 8,000 companies audited from NIS2 directive. But it doesn't mean that we shouldn't be following these adoptions. It's not just about following NIS2 for the sake of potentially being audited. Actually the controls that NIS2 offer and other frameworks that we're also talking about like DORA, CIS benchmarking and so on. All of these actually genuinely improve our cyber security posture.

So if you think outside of the regulations for just a few minutes, implementing some of these security controls are genuinely going to protect your customers from cyber security threats. And so where we start to adopt these regulations and frameworks that we're following, the end goal is actually going to end up improving customers security, cyber security environments and making sure they're that bit more secure. And then as a bonus off the top of it we could also then if we get asked to be audited, we've already got these controls in place to make sure we meet them.

So I would almost be encouraging you guys to think a little bit differently around meeting these standards and maybe if the approach for your customer is I don't need to meet NIS2 because I'm never going to get audited, maybe our attack and our conversation should be less. You're right, you probably won't. However, if we were to implement these controls, just think of the cyber security improvements that we can offer as a result. And that's leveraging things like inforcer's tenant alignment report to demonstrate their security posture.

So where do the key obligations of an MSP sit? And again moving this to four pillars as always from prevention and protection, we've got governance and risk and operations and reporting. These are your concrete obligations as an MSP. Implement a risk management framework, do supply chain due diligence and I know a lot of you do that with us as it is when you come on as vendors on your own vendors. Train your senior leadership. Yes, I really mean it.

Train your senior leadership. Fact, train them on everything. If you are in senior leadership now, ignore everything I'm saying, but if you're not, get your leadership trained up on what's actually required. Go through these sort of models. In fact, you're on a call right now to discuss it today. Enforce strong access controls. And then on the operational side, it's reporting incidents within a strict timeline. And this is probably quite important. 24-hour early warning. We have to pre-warn of incidents and reporting.

We don't have to give specific details. Then it's a 72-hour notification of what that requirement is or what that incident is. And then last but not least, we have to produce within 30 days a final report. That 24-hour early warning is something I think is quite crucial because part of CSIRT is to make sure that we are providing those specific requirements. And Way, thank you for sending that directly. Our secure score thresholds. Thank you.

So as part of the 24-hour early warning requirements, we do need to make sure that if we've seen a security breach, our senior leadership are notified. And it's their responsibility at that point to make sure it's they're notifying where that breach has taken place and who needs to be notified. It's also maintaining tested business continuity plans, BCP continuity plans, disaster recovery plans. Believe it or not, we should be testing those at least yearly. Cooperate with regulators.

If we end up being regulated or we're being audited, I should say, we need to make sure we're providing as much cooperation as possible. And actually it looks good for us with customers if we can genuinely produce good kind of cooperation around making sure not just they're being audited successfully, but if we ever did ourselves. And then the last thing, probably most crucial thing, and actually I think as MSPs we do really well, is document everything.

And I assume probably most of you will actually be laughing thinking we don't document enough. But tickets, believe it or not, do produce some pretty good useful documents if our teams do their jobs right and make sure they're documenting and evidencing properly. But document everything you're doing. And that's the same with policies. Run your assessments like Roy, who's on this call today, he specializes in getting our assessment engine up and running and works really hard to make sure our frameworks and the assessment checks that you guys run in our environment are actually up to date and they're accurate.

But they're really useful. If you run them every single month for your customers and you document this as a result, you can produce some really good pre-baked information and evidence that can be provided to regulators if they're ever asked to.

So it's foolish of me to kind of say these are the things we need to do without understanding what the consequences are of not following this. And I think this isn't designed again to scaremonger any of you on this call today, but penalties and consequences are things that we should be aware of. So as part of essential entities, fines of up to 10 million euros or 2% of global annual turnover, whichever is higher as penalty points, and important entities fines of up to 7 million euros or 1.4% of the global annual turnover.

I will, and I have got this already written in the HTML, it tells you what the differences are specifically between essential and important just as an FYI. But it goes beyond just the penalties of pay EU some money, for example, which essentially we all know is designed to scaremonger, but it also boosts the economy as a result, but it goes beyond fines. Senior management are actually held personally liable for cyber security negligence. It does mean, and it's unlikely, but it does mean that there's potentially court proceedings and legal action that can be taken.

Temporary bans from holding management positions, public disclosure of non-compliant organizations, mandatory security audits by independent bodies. So if you are seen to have been breaching these, there's a possibility you will be audited on a monthly or quarterly basis, and we have seen, and I can send you some evidence if you guys want it, of companies out, particularly in France and in Spain, where they are now being audited monthly because they didn't meet or didn't meet the NIS2 directives.

And they've been given a six-month warning. Suspension of certifications or authorizations for essential services, all of these go far beyond just the fines, but they're also really impactful for individuals and also businesses. We talk about a brand. That's a huge reputational piece of damage there. Just because we don't meet or it might be easy for them to possibly pay fines, but bans on holding management positions for senior leadership, huge problem, public disclosure of non-compliant organizations. If you don't meet those compliance, you're publicly held accountable, which means it's going to go everywhere.

Certifications can also be suspended, mandatory audits imposed as well. It's not just finance department problems, it's a board-level risk when we talk about all of these consequences. It's not financial. It really does hit the board level for some of our bigger customers that we support. And just to clarify, bigger customers, we're talking more than 50 or, you know, more turnover than 10 million euros.

So talk about beyond Microsoft 365 for a second. I know there are controls that we can map to, NIS2 specifically, but what else do we need to look at outside of this? So we've got the incident reporting timeline. Already mentioned this already. Detailed incident notification with an assessment, final report with root cause and remediation. These are things we actually more often than not deal with customers who actually need to have this anyway. But physical and network infrastructure, on-prem servers, firewalls, network appliances, we need to be able to monitor them, report on them, and understand incidents and detect those respond incidents and then respond to them as required.

OT and IoT systems and critical infrastructure, third-party and supply chain risk. So all ICT vendors and service providers must be assessed as well as part of this. Contracts must include security clauses and audit rights. So again, update your MSA agreements if you don't have that detailed correctly. Broader compliance and landscape. So just to kind of give you guys an overview, quite a lot of this aligns closely to ISO 27001. So guess what? If you're already on that journey, you're probably already close to, if not already complete with NIS2.

NIST frameworks for those out in the US, complements specifically DORA for financial sector entities. And then the other ones are UK Cyber Security Bill. It actually mirrors NIS2 for UK operations. So as part of that cyber security bill, which is which has been updated and will be passed shortly, NIS2 it mirrors this already. So we're actually in scope for this with NIS2 already and we will be 100% in scope as a UK business imminently.

So like anything when we talk about these sort of frameworks, where can inforcer help you guys apart from listening to my lovely voice is talking about the NIS2 compliance specifically. We want to be able to give you the tools to standardize, automate and evidence the 365 compliance and do that at scale. And we do this already. So that assessment engine that's been built, the ability to assess these, define and enforce the CIS NIST and any other custom security policies across your client tenants.

That's our alignment piece and the alignment reports you can run. Drift detection, the ability to continuously monitor for configuration drift with real-time alerts on policy configuration changes. Again, already covered and available and this is really important. It's policy depth, guys. It's not just can you provide drift detection on my conditional access policies? We need to know changes made to anything in Microsoft 365 and it's really difficult to retrieve all that information. But the more policy depth inforcer gives, the more notifications you're able to get.

So it's important our policy depth is as big as it can be and we are working tirelessly, our engineering team are working tirelessly to make sure that depth continues to be big and that's why we're the leading partners for policy depth at the moment. Multi-tenant governance. So managing the security posture across the hundreds of tenants from a single pane of glass. Yes, what we've got that already and you guys are using it. The evidence exports.

This is quite important. This is actually more to do with your assessments. So when you run an assessment around NIS2 as an example, that's your evidence. You're producing a report to prove that this control meets this requirement and this is the configuration profile and this is the proof. We've run an assessment check i.e. inforcer's done that for us. And the other one's automated remediation. So although we don't provide specific auto fixes just yet, once you've got that alert, you've got the ability to go straight in and reverse or realign those policies and changes that take place.

So inforcer, it's also important to know, needs to map to NIS2 as well. So outside of what we can do in terms of giving you the tools for 365, it's also making sure that we can map ourselves to NIS2 measurements. So risk analysis, that's our baseline enforcement, drift detection, risk based tenant assessments, the assessment engine, the incident handling, the real-time alerting on policy and changes because again, we're still part of your supply chain here. Business continuity.

So configuration backup is what we cover. Automated recovery as well for an for a good known state. Supply chain, multi-tenant visibility into client security posture across your portfolio. You've got your access control, the MFA enforcement. That's our RBAC management, the ability to use your own PIM for managing access with security groups. Effectiveness, continuous compliance scoring and trend reporting over time. So we giving you guys as many mappings that we can also map to for NIS2. So where we talk about what we need to offer or provide for auditors, all of this is also included and available for you guys to leverage.

So I'm coming to the end transparently. So finishing up with the last one, maybe two slides is this specific one here. Where do we leave you at the end of this? And the reality is it's quite difficult sometimes when you walk away from these course to go yeah that was really informative that was great but what do I do next or where's my next journey going to take me? So what myself, my colleague Roy and some others have done is we've pulled together an Excel checklist of things you need to do as part of those articles that we're following in NIS2 directive around Microsoft 365.

I might point out we're also giving you an HTML which gives you a breakdown of what NIS2 is, where the fines sit, essential entities and important entities, the differences, the mappings, what NIS2 requirements there are for us as MSPs, and then that Excel checklist as well. How do we go about mapping these? This is just really an opportunity for you guys to make sure and I would encourage you over the next couple of months just to go through this checklist and say do we meet these standards?

Because if you end up going through it and you find your 90 percent there that last 10 percent is going to be a big game changer. It's actually worth the investment to take time to do so, and it's for two reasons. One, it makes you NIS2 compliant ready to go if you ever got regulated. But also you've got a list of exactly the controls that you need to make sure implemented for your customers, and that's project revenue opportunities right there.

If they don't have it and it's a requirement, you've already got the scope, you've already got the ability to deliver this as a project opportunity. Revenue changes and your professional services are a huge part of the income and the profitability of a business, and this is a really good opportunity for us to make sure we're mapped to it, but can we also map our customers to it as well? And that, guys, is a wrap for me.

If you've got any questions, please put them in the chat, or feel free to email your PSMs. But thank you very much for your time today, and if you're also a prospect, as I should always say, feel free to book in a demo to know more. Yes Andreas, we will share the Excel and HTMLs. They'll come in an email post this session today. Great, thank you very much. A wonderful rest of the day. Cheers, guys.