Compliance and regulation are rules and legislative frameworks that businesses must follow to operate ethically, legally, and responsibly.
Global scale economy, its self-interconnection and the growth of cyber threats that threaten the availability of services, the integrity of systems and the confidentiality of data are increasing on yearly basis. It is not just about sophisticated cyber-attacks, but also human errors associated with the configuration of the IT environment, non-application of basic security policies in organizations, or insufficient user awareness. That all is reason governments are also trying to mitigate the risks associated with this in the form of various legislative measures.
There are many legislative measures and we can divide them into three areas. The first is international regulation, which is superior to national legislation and regulated entities must follow the given regulation (e.g. GDPR). The second, we have various national legislative measures (laws), which may differ from country to country. Third one are international directives (e.g. NIS2, RCE, DORA), which are kind of general framework for creation of national legislative measures. Individual countries are obliged to transpose these directives in their national legislation, in the form of laws and/or executive decrees and/or recommendations. Nationally competent authorities (e.g. NSA) are responsible for supervising of that obligations arising from these legislative frameworks. According to this legislative framework, the following regulated entities apply compliance measures.
Fulfill cybersecurity compliance and regulation standards, including data protection, incident prevention and breach reporting obligations with Flowmon’s intelligent network monitoring and analysis.
The Network and Infrastructure Security (NIS 2) Directive (effective since Dec 2022) is an update to the original NIS Directive (effective since July 2016) and aims to strengthen the cybersecurity resilience for EU Member States. It sets out new rules for managing cyber risks, incident reporting, and cooperation between EU Member States, among other things. The directive covers a wide range of essential and important entities, including energy, transport, banking, healthcare, and digital infrastructure. Its main goal is to ensure that infrastructure of operators of essential and important services have appropriate security measures in place to prevent their systems and data from cyber security incidents as well as they would be able to respond and report effectively to any significant incident that occur.
The NIS 2 Directive was adopted by the European Parliament and Council in December 2022 and EU Member States have until October 17th 2024 to transpose it into their national legislation framework.
By 17 October 2024, Member States shall adopt and publish the measures necessary to comply with this Directive
T = effectiveness of NIS 2 (Jan 2023)
As an essential and important entity, the NIS 2 Directive means that you are subject to specific cybersecurity risk management requirements designed to protect your infrastructure from cyber threats. The directive requires you to implement appropriate security measures to prevent cybersecurity incidents and to report any significant incidents that occur to the relevant national competent authorities. It also encourages cooperation and information-sharing between EU Member States and relevant stakeholders to enhance overall cybersecurity to ensure service availability, system integrity and data confidentiality.
During this period till NIS 2 will be transposed into National Legislation framework all potential essential and important entities would follow mainly Article 21 of NIS 2 and provide Risk Analysis, GAP Analysis and Business Impact Analysis if they have implemented all minimum measures described in that Article based on Asset Inventory.
After National Legislation effectiveness National Competent Authority will require registration of all regulated entities (described in ANNEX I and II of Directive) and their list of essential and important services based on specific § criteria of National Legislation, but at least till Jan 17th 2025. National Legislation will have definitely wider scope of requirements need to be met than is described in directive.
Based on specific & criteria of National Legislation supervisory National Competent Authority of enforcement measures in respect of the obligations of regulated entities will require to provide regular or ad hoc and targeted security audits carried out by an independent body or a competent authority. In case of ineffectiveness of results regulated entities will need to take appropriate action to remedy or will be sanctioned.
Each Member State shall designate or establish one or more CSIRTs within a National Competent Authority for ensuring high availability communication channel with regulated entities and other third countries CSIRTs for information sharing. Moreover CISRTs shall be equipped with an appropriate redundant system for managing a routine requests to ensure continuity of their services and shall promote the adoption and use of common or standardised practices, classification schemes and taxonomies regarding incident handling procedures, crisis management and vulnerabilities disclosure. Based on specific § criteria of National Legislation CSIRTs shall follow these particular tasks:
Flowmon is a comprehensive intelligent network security monitoring solution that provides real-time visibility into network traffic and helps organizations detect cyber threats and respond to cyber incidents. This directive is all about security of network and information systems to resist to any event that may compromise the availability, authenticity, integrity or confidentiality of data or services transmitted through network.
Here's how Flowmon can help you achieve NIS 2 compliance:
NIS 2 requires organizations to have an "early warning mechanism" to detect and respond to cyber threats. Flowmon uses advanced algorithms to analyze network traffic in real time, detect anomalies and indicators of compromise (IoCs), incl. 0-Day vulnerabilities. This helps regulated entities and CSIRTs identify potential threats early and take proactive action to prevent them from cyber security incident.
NIS 2 requires organizations to have incident handling and management on place to minimize the impact of cyber security incidents. In the event of a security incident, Flowmon provides automated detection and analysis to containment. Moreover, Flowmon collect all data for months and years for digital network forensic that can be used to identify footprints of triggered incident. This helps regulated entities fulfill whole incident handling process and get appropriate information for Incident Reporting obligations.
NIS 2 requires organizations to have "comprehensive monitoring" of their hybrid networks to analyze essential and important services availability and functionality. Flowmon provides visibility into encrypted traffic and ensure regulated entities has implemented appropriate encryption procedures and also detect and respond on hidden threats within encrypted traffic.
NIS 2 requires regulated entities and CSIRTs to collect and analyze data when cyber incident occur. That "provide competent authorities with evidence" of structure of digital footprints within national network traffic. Complete visibility into traffic, including real-time monitoring of network and application performance allows regulated entities and CSIRTs identify unusual activity on their networks and take action before it becomes a problem with services availability, systems integrity or data confidentiality.
It also encourages cooperation and information-sharing between EU Member States and relevant stakeholders to enhance the overall cybersecurity of EU cyber infrastructure.
The National Cybersecurity Authority (NCA) established as part of the Kingdom of Saudi Arabia’s 2030 Vision is the central authority responsible for overseeing cybersecurity in Saudi Arabia. It plays a crucial role in formulating policies, guidelines, and regulations to protect critical infrastructure and mitigate cyber threats. Its mandate was approved as per the Royal Decree number 6801, dated 11/2/1439H making it the national and specialized reference for matters related to cybersecurity in the Kingdom.
NCA developed 3 main cybersecurity controls within years 2018 – 2020:
Subject Regulated Entities (SREs) are the entities that are subject to the Essential Cybersecurity Controls in Saudi Arabia. SREs include:
Subject Regulated Entities (SREs) in the context of Critical Systems Cybersecurity Controls typically include organizations and entities that own, operate, or are responsible for critical systems and infrastructure. The specific entities can vary, but commonly regulated entities can include:
Subject Regulated Entities (SREs) in the context of Cloud Cybersecurity Controls typically include organizations and entities that utilize cloud services. The specific entities can vary, but commonly regulated entities can include:
Cybersecurity controls defines key objectives must be focused on in order to protect the organization’s information and technology assets – Confidentiality, Integrity and Availability. These controls take into consideration the following four main cybersecurity pillars – Strategy, People, Processes and Technology.
Structure definition of all Domains, Subdomains, Controls and Sub-Controls contains these fundamental measures need to be implemented and be following NCA regulations:
As an SRE means that you are subject to specific cybersecurity requirements designed to protect your infrastructure from cyber threats. The regulation requires you to implement appropriate security measures to prevent cybersecurity incidents and to report significant incidents that occur to the NCA and The ECC requires the appointment of a “Competent Person” to ensure the organization’s cybersecurity strategy is full in compliance with these regulations.
How can Flowmon help you be ECC (CSCC, CCC) compliant
Flowmon is a comprehensive intelligent network security monitoring solution that provides real-time visibility into network traffic and helps organizations detect cyber threats and respond to cyber incidents. All these regulations require (2) Cybersecurity Defense as an important domain to leverage overall SREs (3) Cybersecurity Resilience, (4) Third-Party and Cloud Computing Cybersecurity and (5) Industrial Control Systems (ICS) Protection.
Here's how Flowmon can help you achieve (2) Cybersecurity Defense Domain compliance trough main approaches like Threat Detection and Threat Hunting, Incident Response and Digital Forensics, Hybrid Cloud Monitoring and Encrypted Traffic Analysis and Root Cause Analysis and Performance Monitoring in single pane of glass for:
USE OUR SLIDE NIST INCIDENT REPONSE CYCLE
Although there are no penalties set out in the ECC all SREs must report all significant incidents to NCA (as a cybersecurity competent authority within Kingdom of Saudi Arabia) responsible also for education, training, and raising awareness about cybersecurity through establishing affiliated centers.