What It Is

NIS2, officially Directive (EU) 2022/2555, is an EU regulation expanding the original NIS Directive. It establishes a high common cybersecurity level across member states by bolstering resilience of critical infrastructure and digital services. Applies risk-based, all-hazards approach to essential and important entities.

Key Components

• **Risk managementContinuous assessments, supply chain security, access controls, encryption.
• **Incident reporting24-hour early warning, 72-hour notification, one-month final report.
• **Business continuityCrisis response and recovery plans.
• **Corporate accountabilitySenior management direct responsibility. Aligns with standards like ISO 27001, NIST CSF. Compliance enforced via national authorities, spot checks.

Why Organizations Use It

Mandatory for in-scope entities to avoid fines up to €10M or 2% global turnover. Enhances cyber resilience, ensures service continuity, builds stakeholder trust. Supports multi-state operations amid evolving threats.

Implementation Overview

Conduct gap analysis, implement measures, register with CSIRTs, train staff. Targets medium/large entities in 18 sectors (e.g., energy, transport) across EU. Ongoing supervision, no formal certification but aligns with frameworks. Transposed nationally by October 2024.

What It Is

AS9120B is the IAQG quality management system standard for aviation, space, and defense distributors. It augments ISO 9001:2015's high-level structure with distributor-specific requirements. Primary purpose: mitigate risks like traceability loss, counterfeit parts, and documentation errors in procurement, storage, splitting, and resale without altering products. Employs risk-based thinking and PDCA cycle.

Key Components

• Over 100 aerospace additions to ISO 9001 clauses 4-10.
• Pillars: context analysis, leadership, planning, support, operations (traceability, counterfeit prevention, external providers), performance evaluation, improvement.
• Built on 10-clause HLS; certification via accredited bodies with OASIS listing.

Why Organizations Use It

• Commercial necessity for OEM/Tier-1 supply chains.
• Reduces supply chain risks, builds customer trust via auditable chain-of-custody.
• Enhances efficiency, market access (2,442 global certifications), competitive edge.

Implementation Overview

• Phased: gap analysis, process design, training, audits (6-12 months).
• Applies to distributors globally; requires internal audits, management review, certification audits.