Raising Awareness about NIS2 with Senior Management

Raising awareness about the critical importance of cybersecurity in the OT environment has always been difficult. Senior Management is measured on results that include the quantity of the company’s products that leave the plant for consumer shelves. Cybersecurity is often seen as an impediment to production as it acknowledges a host of new problems that might interfere with unbridled manufacture processes.

Ready or not, the Network and Information Security Directive 2 (NIS2), coming into effect later this year, is focusing attention on cybersecurity in OT environments. There is nothing like holding senior managers personally responsible for security to finally force them to implement security measures and risk management programs in their plants and factories.

You can read about the relevant requirements of NIS2 here. For more information concerning the liabilities, fines, and penalties for non-compliance, download our free and highly useful whitepaper, NIS2 is Coming to OT Security: Are You Ready?

So, today, with the sudden focus on OT Security caused by the impending NIS2 Directive, there is a good opportunity for the OT Security community to get the buy-in of senior management. But, it’s not so easy to get other people to think a new way. Below, we recommend steps that will help OT Security managers get through to Senior Management and finally receive the attention – and budgets – that OT Security deserves.

Educate Yourself

Before you can effectively raise awareness, ensure that you have a solid understanding of NIS2. Familiarize yourself with its objectives, requirements, and implications for your organization. Know what the stakes are, including penalties for non-compliance. As mentioned above, our NIS2 whitepaper is a great resource.

Identify Key Stakeholders

Determine who the key decision-makers and influencers are within your organization. These could include C-suite executives, board members, heads of departments, legal departments, and production managers. Newly appointed compliance officers will eagerly become your allies.

Tailor Your Message

Craft your message in a way that resonates with the priorities and concerns of senior management and other stakeholders. Highlight the positives: how compliance with NIS2 can mitigate risks, protect the organization’s reputation, and ensure legal compliance. Don’t be afraid to mention the negatives: the liabilities, fines, and penalties. Don’t convey these as threats, but as legitimate concerns.

Provide Examples and Case Studies

Use real-world examples and case studies to illustrate the potential impact of NIS2 compliance (or non-compliance) on similar organizations. Highlight recent cyber incidents or regulatory fines that could have been prevented with NIS2 measures in place. Here are some still-hot blogs that underline recent OT cyber incidents:

• Holding Water
• AnyDesk Breach
• Rockwell on the Cyber Rocks
• Did The Guardian Help Us Avert a Nuclear Disaster?

Highlight Business Benefits

Senior Management does not engage with the realm of cybersecurity whose terms may seem baffling. So, while it’s vitally important to you, don’t push the technical jargon. Emphasize the potential business benefits of NIS2 compliance, such as improved cybersecurity posture, increased customer trust, and enhanced competitiveness in the market. These are concepts that will resonate with the C-level.

Quantify Risks and Costs

If you are a production engineer or an OT Security analyst, you know the undeniable power of the figures. Provide senior management with a clear understanding of the potential risks and costs associated with non-compliance. These could include financial losses from data breaches, regulatory fines, legal fees, and damage to brand reputation. Give them numbers from the costs of recent cyber attacks, actual fines from GDPR breaches, and the potential fines from NIS2 non-compliance.

Propose an Action Plan

Present a clear, actionable plan for achieving NIS2 compliance within the organization. Break down the steps involved, including regular risk assessments, gap analysis, implementation of effective security measures, incident reporting processes, and ongoing monitoring and review. Radiflow has a lot of experience in all these areas, so don’t hesitate to call on us for help.

Engage in Dialogue

Foster an open dialogue with senior management, allowing them to ask questions and express their concerns. Address any misconceptions or misunderstandings about NIS2 compliance with positive, business-oriented answers, the kind that C-level execs understand.

Collaborate with Compliance and Legal Teams

Your organization already has a legal team and maybe even a compliance officer or department. These are your allies. Work closely with them to ensure that senior management understands the legal and regulatory implications of NIS2.

Provide Ongoing Updates

As you well know, OT Security is not a one-shot issue. Keep senior management informed about the progress of NIS2 compliance efforts and any relevant developments in cybersecurity threats or regulations. This helps to maintain their engagement and support over the long term.

Path to Success

OT Security requires buy-in by senior management; they make the ultimate company decisions and allocate the budgets. By following these steps, you can effectively raise awareness about NIS2 and garner support from senior management for compliance efforts within your organization.