NIS 2 has come into effect, and by October 2024 EU-member states are required to add this Directive to their legislation. For MSPs and MSSPs, NIS 2 is an opportunity to position themselves in front of their clients as a trusted partner and a security and compliance leader and expert. Below, we detail how you can help your clients meet the new requirements and even how to overcome any objections they may have.

Brief Reminder: What is NIS

The Network and Information Systems (NIS) Directive is an EU legislation designed to strengthen network and information system security in the EU. Adopted in July 2016, it was the first EU-wide legislation on cybersecurity.

According to NIS, organizations are required to adopt cybersecurity strategies to enable service continuity. They also need to report incidents that impact this ability. NIS applies to various sectors, including energy, transport, banking, financial market infrastructures, health, drinking water supply and distribution and digital infrastructure.

What is NIS 2? What Does it Add on to NIS?

NIS 2 is an update of the NIS Directive. It came into act in July 2023 and EU member states are required to add it to their legislation by October 2024. NIS 2 aims to expand NIS, adding new cybersecurity requirements and new sectors that are required to comply This is meant to enhance the resilience and incident response of the EU and its public and private entities.

The main additions include:

Broader Sector Coverage

A number of new sectors are required to comply with NIS2. These include digital infrastructure providers, public administration entities, food production and distribution, waste management and more. The expansion is meant to ensure a comprehensive approach across critical services to enhancing cybersecurity.

Mandatory Cybersecurity Measures

There are a number of specific cybersecurity measures NIS 2 requires:

• Access controls
• Incident detection and response
• Regular security audits
• Supply chain security controls
• Employee training programs

These measures are designed to ensure that organizations have a robust cybersecurity framework in place to protect against threats.

Enhanced Incident Reporting Requirements

NIS2 mandates stricter incident reporting obligations. Organizations must report significant cybersecurity incidents to national authorities or CSIRTs within 24 hours of detection, followed by a detailed report within 72 hours. Impacted recipients must be notified immediately. This aims to ensure timely and effective incident response and coordination. 

Stronger Risk Management and Governance

With NIS2, organizations are required to implement robust risk management practices. This includes regular risk assessments, the adoption of appropriate technical and organizational measures and ensuring top management is actively involved in cybersecurity governance and oversight.

Focus on Supply Chain Security

With NIS2, organizations are required to assess and manage the cybersecurity risks posed by their suppliers and service providers. This includes ensuring that third-party vendors comply with relevant security requirements and integrating supply chain security into overall risk management strategies.

Penalties for Non-Compliance

Non-compliance with NIS 2 can lead to significant penalties. These can even reach €10,000,000 or 2% of the global annual revenue, whichever is higher.

Harmonization Across the EU

NIS2 sets common standards and requirements. This is intended to reduce disparities in cybersecurity practices and enhance the overall security posture across the EU.

Increased Cooperation and Information Sharing

NIS2 advocates for increased cooperation and information sharing between member states, national authorities and organizations. This includes participating in information sharing groups, reporting incidents, and sharing threat intelligence to improve collective cybersecurity resilience.

How MSPs and MSSPs Can Help Their Clients Meet NIS 2

Your clients are busy, and sometimes do not have the time, bandwidth or resources to ensure they are planning for NIS 2 compliance. This is where you can help. Follow these practices:

1. Conduct Comprehensive Risk Assessments

Perform detailed risk assessments for each of your obligated clients, to identify vulnerabilities and areas that need improvement, based on the NIS 2 framework. Use these assessments to tailor security measures to each client’s specific needs. An automated and AI-based vCISO platform that supports compliance capabilities can assist, streamlining the process, ensuring a comprehensive and structured assessment can create a clear report that can be shared with the client.

2. Recommend the Implementation of Robust Security Measures

Advise your client to deploy essential security controls. These include access control, firewalls, intrusion detection/prevention systems, endpoint protection and encryption. Ensure these measures are continuously updated and monitored. While they are not all listed in NIS 2, they all allow meeting the NIS 2 requirements for basic security hygiene. 

3. Develop and Manage Incident Response Plans

Work with your clients to create customized incident response plans. The plan should outline  procedures for detecting, reporting and responding to cybersecurity incidents; backups and redundancy for business continuity; and authority reporting procedures. Regularly test and update these plans to ensure they remain effective.

4. Provide Continuous Monitoring and Logging

Set up continuous monitoring systems to detect and respond to security threats in real-time. Implement logging solutions to record security events, ensuring logs are regularly reviewed and maintained. This will help with quick response to incidents and with reporting to authorities about incidents, as required by NIS 2. It can also help your clients maintain transparency and trust with their own end-users.

5. Facilitate Compliance Training and Awareness

Offer regular cybersecurity training and awareness programs for your clients. Explain to them what they are required to do under NIS 2 and how it strengthens their security strategy. This will help them prepare and also instill confidence in their ability to meet NIS 2 requirements.

6. Develop Comprehensive Security Policies

Assist customers in developing and maintaining comprehensive security policies and procedures that align with NIS2 requirements. Ensure these policies are regularly reviewed and updated. An automated platform can help develop such policies with AI.

7. Enhance Supply Chain Security

Evaluate the cybersecurity practices of your clients’ third-party vendors and service providers. Help customers integrate supply chain security into their overall risk management strategies. You can use the same platform you used to assess your clients, on their suppliers (with their consent).

8. Prepare for Incident Reporting

Establish clear processes for timely and accurate incident reporting to relevant national authorities or CSIRTs. Ensure customers understand what constitutes a reportable incident. how to report it and when. An automated vCISO platform can help generate immediate reports that shorten the process. 

9. Utilize Automated Compliance Tools

Automated compliance tools can help customers manage and document their compliance efforts. These tools can simplify the process of gathering evidence, tracking progress and generating reports. For example, an AI-based vCISO platform helps assess the client’s compliance posture based on the specific required framework, identify gaps, create a plan, track it and generate reports.

10. Ensure Regular Security Audits and Assessments

Conduct regular security audits and assessments to track progress and ensure ongoing compliance with NIS2 requirements. Use the findings to continuously improve security measures and address any gaps.

11. Support Business Continuity and Disaster Recovery Planning

Assist customers in developing and maintaining business continuity and disaster recovery plans. Regularly test these plans to ensure they are effective and up-to-date.

12. Promote Information Sharing and Collaboration

Encourage customers to participate in information sharing and collaboration initiatives with other organizations, sectoral bodies and national authorities. This can enhance their collective cybersecurity resilience and also encourage them to implement more security practices, which is an upselling opportunity for you.

How MSPs Can Convince Their Clients to Follow NIS2 Compliance

While complying with NIS 2 is non-negotiable, not all your clients might be enthusiastic about planning and executing its requirements. Here are a few strategies the can help you show them the value of doing so:

• Highlight Regulatory Requirements – Clearly explain the legal obligations and requirements of the NIS2 directive. Emphasize that compliance is mandatory for their sector and non-compliance can result in significant penalties and legal repercussions.

• Demonstrate Business Benefits – Show how NIS2 compliance can enhance their cybersecurity posture, reduce the risk of cyber incidents, provide a competitive advantage and protect their reputation. Explain that a strong cybersecurity framework can lead to increased customer trust and potential business opportunities.
• Emphasize Risk Mitigation – Provide examples of cyber incidents that impacted similar businesses. Highlight how compliance with NIS2 could have mitigated these risks and protected the business from financial and operational disruptions.
• Offer Success Stories – Share testimonials and success stories from other clients who have benefited from NIS2 compliance, demonstrating its positive impact.
• Offer a Compliance Roadmap – Present a clear, step-by-step roadmap for achieving compliance. Break down the process into manageable phases, showing that compliance is achievable without overwhelming their resources. A vCISO platform can help build such a plan.
• Show Cost-Effectiveness – Illustrate how investing in compliance now can save money in the long run by avoiding fines, reducing the cost of incident response and minimizing downtime from cyber incidents.
• Leverage Your Expertise and Tools – Demonstrate your expertise and experience in cybersecurity and compliance. Highlight the tools and services you offer that will simplify the compliance process, such as automated compliance management, continuous monitoring and incident response. This is also an upselling opportunity for you.
• Provide Customized Solutions – Tailor your services to the specific needs and risks of the end-customer. Show how your customized approach addresses their unique challenges and aligns with their business objectives.
• Promote Continuous Improvement – Emphasize that cybersecurity and compliance are ongoing processes. Offer to support them with regular updates, training, and assessments to continuously improve their security posture.
• Build Trust and Relationships – Establish a strong relationship based on trust. Show that you are a partner in their success, not just a service provider. Regularly communicate and provide updates on progress and emerging threats.
• Create Awareness Programs – Conduct workshops, webinars and training sessions to educate your end-customers on the importance of NIS2 compliance. Awareness programs can help them understand the directive and its implications better.

For Cynomi Users

Cynomi is an AI-based and automated vCISO platform for MSPs and MSSPs looking to grow revenue and streamlining security and compliance processes. Cynomi’s compliance coverage includes NIS 2. With Cynomi, MSPs and MSSPs can:

• Conduct simplified and automated compliance assessments to determine client’s readiness for NIS 2
• Create an automated remediation plan to address NIS 2 gaps
• Report on progress with comprehensive and shareable reports that can also be used with management and auditors
• Show value over time, positioning themselves as a business partner and compliance expert

Using Cynomi, you can assist your clients become NIS 2 compliant and grow your revenue, without straining your own resources or having to invest significant time and effort in becoming a NIS 2 expert.  Start today.

The CrowdStrike Incident is the most large-scale computing incident to occur in the past 14 years, impacting millions of businesses worldwide. Fixing this issue requires extensive IT efforts, but  is also impacted by how each organization practices cybersecurity hygiene. In this article, we explain why MSPs and MSSPs should be involved in fixing efforts and how they can help their SMB clients in the short and long-term.

Why Should CyberSecurity Experts and MSSPs/MSPs Care?

The 2024 CrowdStrike incident resulted from a bug in the release. This seems to be a development/IT issue. Why should professionals engaged in cyber security take notice of this event? There are four main reasons:

1. First and foremost, the ability to fix the issue partially depends on cyber security hygiene. We provide more details below, but the main idea is that an organization’s cyber security practices directly impacted their ability to bounce back, making security teams and MSPs/MSSPs key players in this incident.
2. While the CrowdStrike incident is not a cyber security incident, its implications are similar. Security teams can leverage this incident to develop a plan to prevent similar incidents and an incident response tools that deals with them.
3. The incident compromised the availability of systems and information. Since cybersecurity deals with information confidentiality, integrity and availability, security teams should consider being involved in the fixing process and in the long-term plans to prevent such incidents from recurring in the future.
4. This bug was part of a security tool release, to a vulnerability scanner, which is part of the security stack and in their realm of responsibility.

Here’s more on why you should care, from William Birchet, founder of the vCISO network and vCISO consultant, and David Primore, CEO and co-founder of Cynomi.

What Happened?

On July 19, CrowdStrike issued a software update to their Falcon Sensor vulnerability scanner. The update was intended to fix a high memory utilization issue. A bug in the release disrupted dozens of millions of Windows users worldwide, showcasing the “blue screen of death”. Systems were forced into a bootloop of constant rebooting..

CrowdStrike issued an updated release to fix the issue. However, since many of the impacted devices were unable to connect to the internet to download the update, they remained stuck in the blue screen of death.

To overcome this, Microsoft has advised customers to reboot in Safe Mode or Windows recovery Mode. Then, admins could go into the Windows System Directory, remove the infected file, reboot and obtain the updated release. However, doing so requires local account access and privileges. Another option enables recovering from WinPE, but this requires BitLocker encryption keys, which are not always available. As of now, there is no other immediate available fix, though Microsoft and CrowdStrike are constantly working on new solutions.

There are millions of impacted businesses. These include airline providers, healthcare services, financial services, emergency call centers, news, SMBs and many more.

The Importance of Cybersecurity Hygiene

Fixing the corrupted CrowdStrike file touches upon two cybersecurity best practices.

1. Local admin access and privileges – Accessing Windows System Directory and rebooting through Safe Mode requires proper management of local admins and their ability to access sensitive files. This involves PAM – Privileges Access Management. However, many organizations have removed these local accounts, resulting in their inability to reboot in Safe Mode.
2. Storing backup encryption keys – To recover from WinPE, organizations might need their BitLocker keys. These are often stored in the Domain Controller, but in this case it is also stuck in the blue screen of death. If the organizations didn’t store their backup recovery keys elsewhere, they cannot use this option.

If you are dealing with these issues, continue to follow Microsoft and CrowdStrike updates for more future solutions.

How MSPs/MSSPs can Help Their SMB Clients: Short-Term

Small and medium businesses are exceptionally vulnerable to this incident, since they lack the resources to fix the issue or the pockets to sustain until it is. For security, many of them rely on MSPs and MSSPs. This is an opportunity for these service providers to act as trusted business and security partners and assist their clients until the issue is resolved.

One of the challenges MSPs/MSSPs face is how to access impacted devices. In most cases, you are probably accessing your clients’ networks remotely. However, in such an outage Remote Management tools are also offline. This requires MSPs and MSSPs to come to every site and touch every computer.

How MSPs/MSSPs can Help Their SMB Clients: Long-Term Business Planning

In addition to the immediate fix, this is an opportunity for MSPs/MSSPs to help build and develop their clients’ long-term business continuity plan (BCP).

Don’t start from scratch. Download the BCP template and sample and hit the ground running.

Ensure you execute every step correctly by downloading the XLS risk assessment template. 

Why BCP?

Various types of incidents – attacks, outages, wars, natural disasters, and more – can impact industries and businesses around the globe. A business continuity plan ensures that despite such incidents, businesses can continue to operate and deliver goods and services to their clients. A good business continuity plan can be the difference between whether your client’s business survives or not.

A business continuity plan consists of business impact analysis, risk assessment, recovery strategies, actionable plans, roles and responsibilities, incident response, communication plans, employee training, drills, IT disaster recovery, and more.

Cynomi offers a customizable business continuity plan policy, enabling you to develop, plan and track the implementation of the BCP for your clients’ specific needs. With Cynomi, you can scan and understand your clients’ readiness, build detailed policies with actionable tasks, track and measure progress and report the status to your clients’ leadership. To learn more about how to get started, click here.

William Birchett, President of Logos Systems, and myself discuss CMMC 2.0.

There’s growing interest in the Cybersecurity Maturity Model Certification (CMMC) 2.0 among all organizations that cater to the defense sector. This is particularly impactful for Managed Service Providers (MSPs)and Managed Security Services Providers (MSSPs) who must understand and meet these standards in order to ensure their clients take the right security measures This also presents a unique opportunity for MSPs and MSSPs to grow and differentiate their business. 

I met with William Birchett, a seasoned CISO from Logos Systems, to discuss the critical aspects of CMMC 2.0 and its implications for MSPs and MSSPs.

What is CMMC?

CMMC is a formal certification process required for U.S. defense contractors to protect Controlled Unclassified Information (CUI). It ensures that companies involved in the defense supply chain meet specific cybersecurity benchmarks.

While companies may already have foundational cybersecurity practices in place, they are required to undergo the formal CMMC certification process to demonstrate their compliance with U.S. Department of Defense (DoD) cybersecurity requirements.

Who Needs to Comply with CMMC?

Any company that sells products or services to the DoD must comply with CMMC. This includes manufacturers of various items, from hardware to safety gear, making it a broad requirement across different industries.

What are the Levels of CMMC?

CMMC 2.0 includes different levels of certification depending on the sensitivity of information handled and the contract requirements:

• Level 1: Basic cyber hygiene, often allowing self-attestation.
• Level 2: Requires a third-party assessment, particularly for handling more sensitive data.

What’s the difference between CMMC 1.0 and the new update CMMC 2.0? 

• Level 1 organizations can now perform self-attestation. In CMMC 1.0 they were required to carry out third-party audits.
• Level 2 organizations and above must perform third-party assessments, ensuring stringent security for higher-risk information.

What are some challenges of implementing CMMC 2.0?

Achieving CMMC compliance is complex and often misunderstood. Many organizations believe that they’re compliant but fail to fully adhere to the standards. 

Accurate interpretation and implementation of CMMC requirements are essential – this involves integrating NIST 171 and 172 standards and meeting specific federal acquisition regulations.

What is the impact of CMMC 2.0 on MSPs and MSSPs?

CMMC 2.0 applies to Managed Service Providers (MSPs) and Managed Security Service Providers (MSSPs) that work with clients that sell to the defense industry.

To determine the impact, MSPS and MSSPs should identify the following:

1. Service scope: What services are you providing and do they meet the requirements? 

• What encryptions are used? 
• Are you connected to the cloud? Are the cloud providers authorized?

Example 1: Does your RMM let you download files from a customer’s computer? With CMMC those features have to be disabled or they could bring the entire MSSP into the scope of CMMC regulations.

Example 1: Just because a service or product claims to be “FedRAMP equivalent,” does not mean that the requirements are met, it just means they haven’t paid the money to be assessed by the Federal Government – and therefore are not compliant.

2. Business offering: Do you want to continue providing the services you’ve been providing? Or do you want to offer specialized services for the defense sector to meet CMMC requirements?

What are some opportunities for MSPs and MSSPs?

Despite the complexities, CMMC presents a huge opportunity for MSPs and MSSPs to grow and differentiate themselves in the cybersecurity market.

MSPS and MSSPs can become a CMMC Registered Practitioner (RP) or Registered Provider Organization (RPO). This involves relatively low entry costs (starts around $5,500/year) and can open new business avenues. There are also levels above that such as C3PAOs, certified professionals, audit, etc..

Since CMMC certification will apply to all businesses wanting to do business with the DoD, no matter how down-stream they are, there will be many opportunities for MSPs and MSSPs to support their customers in this area.

How to apply for CMMC 2.0 certification?

Whether seeking certification for yourself or your clients, it’s critical to start the compliance process immediately since it will soon be required in every service contract. 

The steps for certification are:

1. Determine your or your clients’ required CMMC level: Conduct a thorough assessment of current cybersecurity practices.
2. Schedule an audit: All CMMC certifications require an audit by a CMMC Third-Party Assessment Organization (C3PAOs). 
3. Submit the audit to the CMMC: All audits must be submitted to the CMMC accreditation body to certify that it was completed by an authorized third-party. The CMMC accreditation body then issues the certification.

Many organizations who believe they are CMMC 2.0 compliant actually do not meet the formal compliance standards. This is an opportunity for you (MSPs and MSSPs) to help your clients better understand the requirements and ensure that they are in fact compliant with the new regulations.