What It Is

NIS2, officially Directive (EU) 2022/2555, is an EU regulation expanding the original NIS Directive. It establishes a high common level of cybersecurity resilience for critical infrastructure and digital services across member states. Primary scope covers essential and important entities in sectors like energy, transport, health, and digital providers, using a risk-based approach with size-cap rules (e.g., 50+ employees or €10M turnover).

Key Components

• Four pillars: risk management, incident reporting, business continuity, corporate accountability.
• Strict timelines: 24-hour early warnings, 72-hour notifications, one-month final reports to CSIRTs.
• Built on standards like ISO 27001, NIST CSF; mandates supply chain security, access controls, encryption.
• Continuous assurance model with spot checks; no formal certification but national enforcement.

Why Organizations Use It

Legal compliance avoids fines up to 2% global turnover or €10M. Enhances resilience against threats, builds stakeholder trust, ensures operational continuity. Provides competitive edge through harmonized EU-wide security.

Implementation Overview

Assess applicability by size/sector, conduct risk assessments, implement measures, establish reporting. Tailor to national transpositions (by Oct 2024). Applies to medium/large EU entities in covered sectors; involves training, audits, governance changes. (178 words)

What It Is

MAS Technology Risk Management (TRM) Guidelines (revised January 2021) are supervisory guidelines issued by the Monetary Authority of Singapore (MAS) for financial institutions. They provide a principles-based framework for managing technology and cyber risks, emphasizing proportionality based on risk profile, complexity, and criticality to ensure CIA triad (confidentiality, integrity, availability).

Key Components

• 15 main sections covering governance, risk frameworks, secure development, IT operations, resilience, access controls, cryptography, cyber defense, testing, and audit.
• Synthesised into 12 core principles like board accountability, asset inventory, third-party oversight, and defense-in-depth.
• No fixed controls; focuses on outcomes with independent assurance.

Why Organizations Use It

• **Regulatory supervisionMAS evaluates observance during inspections; non-compliance risks fines, enforcement.
• Enhances cyber resilience, reduces incidents, builds customer trust.
• Supports digital transformation with secure-by-design practices.

Implementation Overview

• **Risk-based rolloutInventory assets, assess risks, implement controls proportionally.
• Applies to all MAS-supervised FIs; phased for size/complexity.
• No certification; demonstrated via audits, metrics, board reporting.