The EU’s Network and Information Security Directive 2, known as NIS2, is set to be enforced across all member states on October 17th in order to bolster cyber resilience. The new rules focus on actively managing third-party risks, with industry-standard security certifications like ISO 27001 or SOC2 being mandatory for compliance. However, these certifications may not truly reflect a company’s readiness to face cyber threats.
There has always been a gap between compliance and security, but the new regulations are shedding light on this issue by placing a higher emphasis on proving the effectiveness of security measures. This has resulted in a closer examination of organizations’ security practices, revealing cases of “paper-only” compliance. This term refers to companies that have ticked all the technical boxes for compliance but lack a concrete action plan to implement robust cyber defenses.
Aurimas Bakas, CEO at Cyber Upgrade, has pointed out that while the certification process itself is not flawed, it can often be misinterpreted. He emphasized that a focus on documentation can create a false sense of security if organizations do not follow through with implementing processes and ensuring the efficacy of security controls. In many cases, companies may have all the necessary documentation but still fall short of true compliance.
The complexity of modern supply chains and the rapid evolution of systems create numerous vulnerabilities that attackers can exploit to access sensitive data. Many organizations, especially those without in-house cybersecurity experts, may be unaware of potential blind spots where risks lurk. Even small and medium-sized enterprises are exposed to hundreds of risks, highlighting the importance of thorough cybersecurity measures.
Bakas suggested that lack of security incidents can be just as concerning as frequent breaches, as it may indicate a lack of detection capabilities. To test readiness, he recommended hiring a red team of ethical hackers to simulate real-world attacks and assess the effectiveness of security defenses.
The issue of paper-only compliance is widespread across businesses of all sizes. Smaller entities often lack resources for robust security controls and rely heavily on external assistance, which may not always be reliable. Larger businesses may become complacent after obtaining certifications like ISO 27001 and overlook the need for continuous threat monitoring.
Compliance serves as a baseline, but security is an ongoing process that requires constant attention. While certification is essential, it is no longer sufficient to satisfy regulators or protect company assets. Proactive measures are crucial, as preparing for potential cyber threats is always preferable to dealing with the aftermath of a cybersecurity breach.