On 17 October 2024, EU member states will have translated the Revised Network and Information Systems Directive (NIS2) into local law. Any organization that falls under NIS2 — a lot more than were covered by the previous directive — needs to ensure it complies.
As organizations hurry to audit their operations and bring them up to code for NIS2, there’s one area that’s often in danger of being missed. Supply chains. The new directive obliges entities to risk-assess and then harden their supply chains against technology (hardware and software) and relevant non-technical risks1.
This is not something organizations can neglect. The penalties for a cybersecurity incident arising from a supply-chain flaw are just as severe as the penalties for any other kind of breach: fines of up to €7,000,000 or at least 1.4% of the total worldwide annual turnover2.
But how can you secure operational technology (OT) supply chains that often take in hundreds of vendors and thousands of machines of different makes and ages?
The challenges of NIS2 supply-chain compliance
Right now, manufacturers and operators of infrastructure need to confirm that the machines, technologies, and services they procure meet the security requirements of NIS2. But often, there are no specific security standards for these different parts of the OT ecosystem.
Take, for example, connected and automated machinery. The EU Machinery Regulation (EU) 2023/1230 comes into force in 2027. We can expect the text to take its final shape by some time in 2026.
OEMs and operators will then be able to use the regulation to shape their NIS2 compliance strategy for the machines they operate. Until then, they will need to work with OEMs to map NIS2 against a range of other existing standards and use this exercise to create their own machine-compliance plan — one that will meet regulatory requirements.
Other challenges of NIS supply-chain compliance include:
- The hazard threshold: NIS2 states that a breach may not result in a hazard — but how can an OEM or operator know when hazard-prevention measures are sufficient?
- System heterogeneity: often OT operators run systems and machines from multiple vendors and of various ages, all of which need to be made compliant.
- The technical challenge: how can OEMs and operators be confident that they have identified, documented, and mitigated all relevant vulnerabilities?
The initial task is to audit supply chains — the machines, systems, and services being procured as well as, where relevant, the systems used throughout the lifetime of the supplier relationship — as they stand, without hard and fast specifications against which to audit, and then to document those vulnerabilities so they can be addressed.
For organizations starting with little or even no existing knowledge base or documentation, and without the internal expertise and tools required, this can be a daunting and potentially time-consuming task, with no guarantee of a result that commands confidence.
