The implementation of the NIS2 Directive in Germany through the NIS2UmsuCG is a crucial step in addressing the heightened demands on cyber security and the protection of critical infrastructures. In the context of accelerating digitalisation, global networking and the persistent threat of cyber attacks, it is imperative for companies and public institutions to enhance their preparedness for security incidents. The key reasons and benefits of the law are outlined below.
Response to the growing threat situation
The number of cyberattacks has increased dramatically in recent years, and the attacks are becoming increasingly complex and dangerous. Companies in Germany and throughout the EU are facing major challenges:
- Ransomware attacks
Increasing encryption of data and systems where a ransom is demanded for release. This is facilitated by business models such as "ransomware as a service" and the use of cryptocurrencies for payment. - Supply chain attacks
Increasing cyberattacks on service providers and suppliers to compromise companies through supply chain vulnerabilities, which can have far-reaching effects on multiple organizations. - Phishing and social engineering
Attackers use fraudulent emails and communication channels to obtain sensitive data such as passwords or access rights. These attacks are often the starting point for larger incidents. - Increased use of malware
Malicious software that is deliberately infiltrated into networks to steal data, sabotage systems or enable unauthorized access. Malware attacks can paralyze entire IT systems. - Distributed Denial of Service (DDoS) attacks
By overloading networks or services with a flood of requests, attackers cause systems to fail and become inaccessible. - Attacks on critical infrastructure
Cybercriminals and state-sponsored actors are increasingly targeting energy supply, healthcare, transportation and communications. These sectors are of particular importance and failures would have a devastating impact. - Industrial espionage
Cyberattacks on companies to obtain trade secrets, intellectual property or confidential information. This type of espionage often results in considerable economic damage. - Attacks on IoT devices and networked systems
As more and more devices are connected, they increasingly offer a target for cybercriminals. Inadequately secured devices are often used as a gateway for major attacks.
The German Federal Office for Information Security (BSI) has identified an intensification of cyber threats since Russia's war of aggression against Ukraine, which violates international law. In light of evolving circumstances, known threats must be adapted. Cyber sabotage attacks can also result in collateral damage, with critical infrastructures particularly affected. The potential failure of these infrastructures could have significant consequences for society.
The NIS2UmsuCG aims to counter these risks by obliging companies and institutions to implement robust protective measures. Clear specifications for risk management and reporting obligations ensure that incidents can be quickly identified, reported and rectified.
Protection of national and European infrastructure
Digital and physical infrastructure is the backbone of the modern economy. A failure of critical systems in areas such as energy supply, healthcare or telecommunications could have catastrophic consequences, both for society and the economy. The NIS2UmsuCG offers the following advantages:
- Improving resilience: The introduction of strict security requirements strengthens the ability of companies and government institutions to ward off cyber attacks and ensure the continuity of their services.
- Protection of security of supply: Particularly in sectors that are central to public supply, such as energy, water and healthcare, the law ensures protection against potential attacks that could disrupt vital services.
Uniform safety standards in the EU
A central objective of the NIS2 Directive is the harmonization of cybersecurity standards throughout the European Union. Until now, there have been considerable differences between the individual member states when it comes to the security of network and information systems. the NIS2UmsuCG creates a uniform basis for companies and public institutions in Germany that contributes to this:
- A level playing field: companies and institutions across the EU must adhere to the same high security standards. This creates a stable and secure environment for the internal market and reduces the risk of vulnerabilities in one country being used to launch attacks in another.
- Promoting cross-border cooperation: Improved reporting obligations and cooperation between national authorities will significantly increase the ability to respond to cyberattacks at European level.
Improving corporate responsibility and cyber security culture
A key element of the NIS2UmsuCG is the enhanced engagement of company management in cyber security matters. It is becoming increasingly important for companies to ensure that they have appropriate protective measures in place and that they can effectively manage any security incidents that may arise. Managers are required to address the security risks of their companies and to take appropriate measures to mitigate them. This leads to better risk management and a stronger ability to react in the event of a crisis. The law also raises awareness of cyber security in companies, which helps to create a corporate culture in which cyber security is seen as a fundamental part of business operations.
Prevention of financial and economic damage
The NIS2 Directive provides a clear benefit to businesses and government institutions by creating a preventative framework that helps to reduce financial and economic losses resulting from cyber-attacks. With the ever-increasing threat of cybercrime, it is crucial for companies to take effective security measures to minimize long-term financial losses.
Business downtime due to cyber attacks is one of the most serious financial risks to which companies are exposed. The industry association Bitkom e. V. estimated that cyber attacks in Germany caused a total loss of 223.5 billion euros in 2021. A significant proportion of this damage resulted from operational downtime, stolen data, destroyed systems and expensive recovery measures.
The NIS2 directive requires companies to implement preventive measures to prevent such failures or, where this is not possible, to minimise their impact. In addition, risk management enables companies to identify potential vulnerabilities at an early stage and implement appropriate countermeasures through regular risk assessments and the implementation of technical and organisational security measures. Contingency plans and rapid response mechanisms as part of crisis management ensure that companies are able to continue operating in the event of an attack and minimise the impact on business operations.
Implementing the NIS2 requirements may seem costly at first glance, especially in terms of the necessary investment in cyber security measures, training and technology. However, these costs are in direct proportion to the potential savings that can be achieved by preventing cyber attacks.
According to Bitkom, an average cyberattack causes damage of 500,000 euros per year for companies with at least 10 employees. Assuming that the NIS2 measures could help prevent half of this damage, companies would avert an average of 250,000 euros in potential damage per year. Extrapolated to the approximately 14,500 companies that are likely to be affected by the NIS2 directive, this results in damage avoidance of around 3.6 billion euros per year for the German economy. These savings also result from a reduction in system failures and a more efficient use of resources.
In addition to preventing damage, compliance with the NIS2 directive enables companies to establish themselves as reliable partners. There is a growing expectation among customers, business partners and investors for organisations to demonstrate robust cybersecurity measures to protect digital systems and data. By implementing robust cybersecurity measures, companies can not only reduce the risk of cyberattacks but also strengthen the trust of their stakeholders. This can result in enhanced market positioning and long-term business stability.
Another financial aspect of NIS2 implementation is the avoidance of penalties and sanctions that can be imposed for non-compliance with the directive. Companies that violate the reporting obligations or cybersecurity requirements must expect high fines and legal consequences. By investing in the implementation of the NIS2 requirements at an early stage, companies can not only protect themselves from potential cyber attacks, but also avoid the additional costs associated with sanctions.
An important step for the digital future
The implementation of the NIS2 Directive not only entails legal obligations, but also offers significant economic benefits. Compliance with the directive helps to strengthen customer confidence, minimize legal risks and make companies more competitive in an increasingly digital world.
The NIS2UmsuCG is an essential building block in preparing Germany and the EU for the growing challenges of the digital world. It strengthens the resilience of companies and state institutions against cyber attacks and at the same time promotes cooperation at European level. This law is a significant step towards ensuring economic stability and security in an increasingly networked and digitalized world.
