Compliance - Digital tools and personal support

The new EU regulations (NIS2) regarding security and preparedness in critical sectors will directly or indirectly affect most parts of society. For individual companies or organizations, it is important to determine if they are affected by the regulations – although a more reasonable question is probably how they are affected by NIS2. How the EU directive will be implemented in national legislation is still unclear, but with the overall guidelines of the directive and the expressed intentions, it is becoming quite clear how companies or organizations should approach and prepare for the new legislation. To assist in the initial assessment, Lantero provides short, overview analyses. In a 15-minute meeting, we go over whether you are clearly and directly affected by the regulations or if you are potentially or indirectly impacted. The goal of the meeting is to better understand how to approach the regulations so that you can take control of the process and allocate resources where they are most effective. Whether you view NIS2 as a compliance issue, a matter of security, or from a commercial perspective linked to customer demands, there is a reason to understand the regulations and have a clear strategy. Taking control of the issue reduces dependency on external consultants and ensures that actions are taken in the right order. Priorities can vary significantly depending on whether you take a compliance perspective or a security perspective, for example. But regardless of perspective, you need to understand where your organization stands in relation to various risks associated with network and information systems. And regardless of priorities, questions about everything from strategies and operational continuity to cryptography, personnel security, or incident management must be considered. Even organizations with a high level of security awareness have reason to review the whole picture and assess to what extent they are working in line with best practices or have made informed decisions based on actual circumstances. The first step is knowing in what way you are affected by the regulations.

As a continuation of the security requirements established in the NIS Directive, the follow-up NIS2 is now being introduced. In the new directive, the requirements are stricter, but most notably, supervisory authorities will be able to impose concrete sanctions on organizations that fail to comply. The directive will be implemented into national legislation during the fall. The main purpose is to raise the level of security within critical sectors of society. However, companies and organizations with an indirect connection to these sectors may also fall under the scope of affected activities. Lantero has developed some questions to help you determine if you need to comply with the regulations. If the answer to any of these questions is yes, you should take a closer look at the regulations and establish a plan or approach to the new rules. * Do we provide services or infrastructure in sectors such as energy, transport, banking, healthcare, water supply, or digital services? * Do we have customers in essential societal operations? (Even suppliers and third-party vendors may fall under NIS2.) * Do we manage critical infrastructure or digital services that impact national security or economic stability? (Organizations that affect national or societal security are generally included.) * Does our organization have more than 50 employees or an annual turnover exceeding 10 million euros? * Are we dependent on networks and information systems to provide our products or services? (NIS2 targets organizations whose operations rely on digital systems.) * Have we previously been subjected to cyberattacks or other security incidents that may have affected our operations or our customers' data integrity? (Companies that handle sensitive data and have been targeted by cyber threats may fall under NIS2.) Given that the directive also affects many subcontractors to the primarily affected organizations, it becomes a concern for many. It is still unclear how thoroughly the follow-up of subcontractors' NIS2 compliance will be conducted, but it is likely that it will be an advantage to demonstrate a structured approach and awareness of where one stands in relation to the framework. "We encounter many who feel that the regulations are too far-reaching and impose requirements on more organizations than necessary. At the same time, there is an opposing view among those who work closely with security issues or have been exposed to various types of attacks. They often feel that the framework is wise for most to adhere to," says Petter Tiger at Lantero.

Lantero has conducted a review of how the municipal sector is working with whistleblowing/whistleblower systems and the types of solutions being used. Generally, there is awareness of the issue, and many municipalities are working methodically and seriously, while a surprisingly large portion still have questionable internal setups for whistleblowing. The largest provider in the sector is Lantero, serving nearly a quarter of Sweden's municipalities. Additionally, many municipalities are working with other reputable providers who offer a satisfactory level of expertise and case management support. Close to five percent of municipalities have established setups through a coordinated routine with other municipalities, which often results in a pragmatic and reasonable handling of confidentiality issues, but may raise more significant concerns about ensuring anonymity and may miss the opportunity for specialized support competence as part of the case management process. "What surprises us in our review of the whistleblowing issue within municipalities is how many still lack support from an independent party," says Andreas Wahlström, Partner Manager at Lantero, who conducted the review. "When serious cases arise, the value of that help usually becomes clear." Around one-fifth of all Swedish municipalities have set up various types of internal solutions. As the legislation in this area is structured, there is room for interpretation regarding what it means, for example, to guarantee independence, ensure anonymity/confidentiality, or report orally, but according to Andreas Wahlström, it is largely a matter of creating security and trust among employees. "If the IT department theoretically has access to information regarding a report, it creates credibility issues, even if there are strict rules for how IT department personnel may access and view the information. It’s worth asking what an organization should do to be able to say it guarantees confidentiality for the whistleblower." As anti-corruption efforts are strengthened within municipalities and whistleblower systems become a more natural part of the work against misconduct, it is likely that the remaining homemade solutions will soon be replaced.