In 2016, the European Commission instituted the first European Union (EU) cybersecurity initiative, the Directive on Security of Network and Information Systems 2016/1148 (NIS Directive). Although the NIS Directive enhanced the EU’s cyber resilience, Member States implemented it differently, leading to fragmented requirements, supervision, and enforcement. In 2020, the Commission reviewed the NIS Directive and decided to update it. As a result, the EU Parliament passed Directive 2022/2555 (NIS2), repealing the original NIS Directive and amending Regulation No 910/2014.
The regulatory framework of NIS2 has to be passed into national law by Member States by October 17, 2024. Therefore, organizations should allocate enough time to evaluate solutions and design security strategies and architectures accordingly. As Member States adopt NIS2 implementing acts, organizations should understand where mobile device security fits into their broader compliance requirements.
NIS2 formalizes the requirements that Member States need to have in their cybersecurity laws.
Building on this foundation, NIS2 standardizes the requirements that member state implementing acts must have, responding to the digital interconnectedness and interdependence that digital transformation creates. Taking an “all-hazards” approach, Article 21 sets out basic network, information system, and physical environment security measures that shall include at least:
To minimize an incident’s impact across interconnected geographic and supply chain technologies, Article 23 establishes strict notification requirements. Covered entities will have to provide the national Computer Security Incident Response Team (CSIRT) or other competent authority about significant incidents, requiring organizations to provide detailed notifications within 72 hours that include:
Significant incidents are defined as:
NIS2 supersedes the General Data Protection Regulation (GDPR) notification requirements. Additionally, opponents are stating that reporting obligations with such short timeframes will have adverse effects on the overall cybersecurity posture as it is often impossible to gain a clear understanding of the threat situation within less than 72 hours.
In Article 6, NIS2 defines “network and information system” as:
“any device or group of interconnected or related devices, one or more of which, pursuant to a program, carry out automatic processing of digital data”
As such, NIS2 extends to mobile devices such as smartphones and tablets.
Public and private entities across the following sectors, as defined in NIS2’s Annex I and Annex II, will have to comply with their Member State’s implementing act:
While NIS2 focuses on medium and large entities, it notes that companies of any size will have to comply with the implementing acts if service disruption could:
For organizations considered Operators of Essential Services (OES) or Digital Services Providers (DSP), securing mobile devices will be fundamental to complying with several NIS2 implementing act requirements.
Mobile Threat Defense fills the security gap that Mobile Device Management (MDM) and Mobile Application Management (MAM) leave behind.
MDM is good at establishing perimeters through device configurations but lacks robust capabilities for detecting app vulnerabilities, malware, and malicious apps, often relying on third-party tools.
MAM exclusively focuses on apps with capabilities that enable companies to protect both user-owned and fully managed devices. However, they fail to provide proactive cybersecurity measures to safeguard all attack vectors.
MTD is essential for a proactive security-first strategy for NIS2 compliance. MTD covers all major attack vectors and supplies the necessary forensic data to fulfill incident reporting obligations. Further, a robust MTD enables organizations to implement cryptography and encryption across all mobile devices.
Compromised mobile devices introduce network and access control risks that undermine information security programs.
With MTD, organizations gain visibility into known and unknown risks and threats like:
With these capabilities, OES and DSP entities incorporate mobile device security that enables comprehensive:
With MTD, OES, and DSP, entities can implement state-of-the-art cybersecurity risk management measures that automate activities like blocking:
Much of NIS2 responds to new risks arising from digital transformation, noting that Member States should take relevant European and international standards into account. Increasingly, international standards focus on zero-trust architectures. MTD supports these initiatives by enforcing security and access controls on mobile devices.
With MTD, OES and DSP entities can set and enforce robust conditional access policies that limit device access to resources after the following:
With MTD, OES and DSP entities have deep forensic data on the device, network connections, and malicious applications that enable their security operations teams to comply with NIS2’s technical reporting requirements. With this forensic data, entities have the information necessary for meeting 24- and 72-hour reporting requirements, such as:
With this information, they can supply initial assessments that incorporate indicators of compromise associated with attacks that use mobile devices as the primary vector.
Zimperium Mobile Threat Defense (MTD) – formerly known as zIPS – is a privacy-first mobile security solution that provides comprehensive mobile security for organizations. Zimperium MTD protects an employee’s corporate-owned or BYOD from advanced persistent threats without sacrificing privacy or personal data.
Zimperium MTD can help organizations identify which mobile devices have risky or banned apps by pinpointing what servers these apps are connecting to and blocking these apps and browsers from sending data off the device to the domains to which the app connects. In addition, by leveraging zero-touch activation, Zimperium MTD can automatically enforce conditional access controls as part of a zero-trust strategy, which prevents the use of enterprise apps and access to sensitive corporate data while these banned apps are installed.
Zimperium MTD is the only on-device mobile security solution that protects against the latest zero-day attacks. As the mobile attack surface expands and evolves, so does Zimperium’s dynamic on-device threat detection. Zimperium MTD detects across all four threat categories — device compromises, network attacks, phishing and content, and malicious apps.
To raise your mobile cybersecurity posture and to prepare for NIS2 compliance in time, contact us today.