Operator cyber security obligations 101. Part Two; what the law needs you to do now

Let’s start in the UK, where The Department for Science, Innovation and Technology is putting out shared  details regarding its planned Cyber Security and Resilience (CSR) bill, which aims to update and broaden the scope of 2018's Network and Information Systems (NIS) regulations.

The line here from HMG is that new legislation is needed to address vulnerabilities, protect the digital economy. And let’s jump straight to what will be the point of all these strange words for your CFP and CFO; if a managed service providers fails to address a known vulnerability after being notified, it could be fined up to 10% of turnover or £100,000 for each and every day the breach is not addressed.

That will affect a lot of us, but the European Union is introducing several significant cyber security regulations that will impose stringent requirements on enterprises, particularly those involved in critical national infrastructure. Here's an overview of each and their implications for businesses.

NIS 2 Directive (Network and Information Security Directive 2)

Effective from January 2023, NIS 2 expands upon the original NIS Directive, aiming to enhance cyber security across the EU. It has a much broader scope than 1, as it now includes more sectors such as energy, transport, health, and digital infrastructure. In terms of operator risk management obligations, organisations must now implement comprehensive cyber security risk management measures, while there is now mandatory reporting of significant incidents within 24 hours to relevant authorities.

There is now increased accountability at the management level for cyber security practices, who will be focused on how non-compliance can result in substantial fines. Bottom line: enterprises trading in Europe must urgently assess their cyber security frameworks to ensure alignment with NIS 2 requirements.

DORA (Digital Operational Resilience Act)

Set to apply from January 17, 2025, DORA focuses on the financial sector, aiming to ensure operational resilience against ICT-related disruptions. Key provisions include:

• Uniform Requirements to establish consistent cyber security standards across EU financial entities
• Third-Party Risk Management that mandates oversight of ICT third-party service providers, including cloud services
• Incident Reporting requiring timely reporting of significant ICT-related incidents
• Testing and Auditing which oblige firms to conduct regular testing of their digital operational resilience.

Financial institutions, then, but also and their ICT partners must prepare for these requirements to maintain compliance. National regulators will have increased oversight powers, and non-compliance can result in fines of up to €10 million or 2% of global turnover.

Cyber Resilience Act (CRA)

The CRA, adopted by the European Parliament in March 2024, introduces cyber security requirements for products with digital elements. Implications include:

• Manufacturers must ensure that hardware and software products are designed with cyber security in mind
• Ongoing security support and updates throughout a product's complete lifecycle
• Non-compliant products may be restricted from entering the EU market
• Requires clear information on cyber security features and compliance for consumers.

Companies producing or selling digital products in the EU must adapt their development and support processes accordingly, then. What would that look like in practice?

1. Evaluate current cyber security measures against the requirements of NIS 2, DORA, and CRA, and any other regional or national cyber strictures
2. Implement robust risk management frameworks to address identified gaps
3. Ensure procedures meet the new reporting timelines and protocols
4. Collaborate with supply chain partners to ensure end-to-end compliance
5. Educate staff and management on new obligations and best practices.

But as noted, due to their critical role in digital infrastructure, telecommunications companies are significantly affected by all this. For one, telcos are explicitly categorised as essential entities under NIS 2, which means they must implement robust technical and organisational cyber protection measures, such as network security, incident response, encryption, and supply chain security.

You also need to have a system in place for all that sub 24-hour mandatory incident reporting to swerve any danger of a fine. Your CFO and CEO will, again, be interested in how executive management will be directly responsible for compliance, which includes risk assessments, employee training, and strategic oversight.

A checklist for defence and common burden sharing

Bottom line is that NIS 2 compels telcos to professionalise their cyber security governance and prepare for greater scrutiny and legal liability.

DORA is primarily aimed at financial institutions, but if you provide services like cloud, data hosting, or connectivity to banks, insurers, or investment firms, you now fall under indirect supervision.

Expect, then, that all your financial clients will demand stricter SLAs, cyber audits, and contractual clauses to ensure their own DORA compliance. Under DORA, operators must enhance transparency and resilience in their services to remain competitive in the financial services sector.

CRA affects hardware and software products with digital components, including routers, modems, IoT gear, and network management software. So, telcos that manufacture, import, or distribute such devices must ensure they can demonstrate:

• Cyber security-by-design
• Secure default configurations
• Vulnerability handling processes
• Post-market updates & support.

To avoid the risk of your non-compliant products being banned from being sold in the EU, telcos involved in hardware distribution or bundling must overhaul product development and support to meet CRA standards.

We can sum this up in this table as:

There are all sorts of (happily) overlapping actions to help you meet these obligations, from governance/management to technical:

People identifying a board-level executive responsible for cyber security, developing and maintaining a comprehensive cyber risk management strategy, and performing regular cyber security maturity assessments. You should also deliver annual cyber security training to all employees, with enhanced training for your technical and risk teams

Operational Implement multifactor authentication, endpoint protection, and encryption, whole also ensuring adequate supply chain risk management procedures are in place and you have a secure network architecture with traffic segmentation. You should also run incident simulations quarterly

Reporting Define an incident response plan aligned with EU reporting standards and guarantee you have a workflow set up to notify the relevant authority within 24 hours of major incidents, and document and log all security events and decisions for audit readiness.

But above all, it’s time to start talking to your customers about all this. No man is an island, and no single link in the cyber security chain has to be strong now—they all have to be. And as one of the core elements of that, that has to start with you.

Part 1 of this conversation starts here.