ZIUR and ADEGI join forces to train SMEs in NIS2
The director of the Gipuzkoa Industrial Cybersecurity Centre, María Penilla, offers training to nearly 50 organisations
ZIUR, the Gipuzkoa Industrial Cybersecurity Centre, and ADEGI, the Association of Companies in the territory, have joined forces to train nearly 50 SMEs in the European NIS2 regulation, which establishes a level of cybersecurity resilience throughout the EU. The director of ZIUR, María Penilla, explained in this session held on 11 March what the directive means, what type of companies it affects and what differences exist between the different EU states, among other issues.
Penilla admitted that “it is complicated” to manage this regulation in a “unified and comprehensive” way, but she gave a series of keys to help organisations apply NIS2, which is generating a lot of uncertainty. In this regard, she has insisted on the need to carry out a risk analysis and security policy for information systems, as well as an incident management protocol.
She has also encouraged SMEs to carry out an incident simulation, which has a defined crisis committee. “In this way, the response protocol can be improved and everyone on that committee will know what they have to do. The response will be much more agile if we have it rehearsed,” she indicated.
Ransomware, “the star attack”
The director of ZIUR has pointed out that, currently, “the star attack is ransomware,” so it is essential to have “a controlled backup” to recover quickly from possible cyber incidents. “It is essential to be able to move forward,” she insisted. As for the supply chain, which can also be attacked, Penilla has asked SMEs to ensure that suppliers follow secure development practices in their ICT products and services.
“In short, NIS2 aims to manage risk appropriately. When we talk about cybersecurity, the risk is never zero, but we have to ensure that the part that we will not be able to cover is as small as possible,” said the director of ZIUR to around 50 attendees.