Most NIS2 sessions cover the same ground: which sectors are in scope, which size of company is caught, how big the fines are. The questions people are actually asking are more practical: What will a regulator want to see? How will supervision differ between sectors, and what does this mean for a small company that has just been sent a long security questionnaire by one of its customers?

Ireland already knows which regulator will handle which sector. The CRU takes energy, water and wastewater. ComReg takes digital infrastructure. The Central Bank takes financial services. None of them have started supervising yet. The law has not been passed, and the Commission has referred that delay to the Court of Justice.

Ofgem offers a useful preview. It has supervised NIS in the UK energy sector since 2018 using the NCSC’s Cyber Assessment Framework, and the way it works there tells us a lot about what to expect here.

CyberSmart will cover what each sector is expected to do, how the checking is likely to work, what smaller suppliers are being asked to prove, and where the Cyber Fundamentals framework fits with NIS2 and ISO 27001. The session is equally useful whether the organisation being asked these questions is your own or a customer’s.

Who should attend?

IT and security leads in organisations covered by NIS2, particularly in energy, water, transport, healthcare, digital infrastructure and the public sector. Compliance, risk and operations managers in companies that supply those organisations. Owners and directors of smaller companies receiving security questionnaires from larger customers. MSPs, resellers and consultants helping customers get ready.

Key Takeaways

In this session, you will learn:

• Why an energy company, a software provider and a hospital face very different expectations under the same set of rules.
• What the CRU is likely to ask for, based on how Ofgem has handled the same job in UK energy since 2018.
• What smaller companies and suppliers are being asked to prove, and how far a customer’s questionnaire can reasonably go.
• Where Cyber Fundamentals fits with NIS2 and ISO 27001, which of its four levels suits which kind of company, and how to avoid doing the same work twice.
• What kind of evidence a regulator will accept, and what tends not to be enough.

Agenda

11:00 – Welcome and Introduction, Norman Newell, Renaissance

11:05 – Beyond the NIS2 Compliance Overview, Jamie Akhtar, CyberSmart

11:45 – Q&A

12:00 – Close