NIS2 Directive’s Impact on the Smart Mobility Ecosystem

The NIS2 Directive, expected to become mandatory in October 2024, aims to significantly enhance the cybersecurity framework within the European Union. It broadens the scope of its predecessor, the NIS Directive, to include critical infrastructures essential to the connected mobility ecosystem such as electric vehicle (EV) charging networks, smart agriculture devices, and various connected mobility applications. The directive underscores the importance of comprehensive cybersecurity measures, highlighting the necessity for detection, prevention, and response strategies to counteract cyber threats effectively.

Understanding the NIS2 Directive

As an advancement of the original Network and Information Systems (NIS) Directive, the NIS2 Directive represents the EU’s commitment to improving cybersecurity across the European Union. The initial NIS Directive faced limitations in its scope and enforcement capabilities, which left significant sectors and digital services without comprehensive cybersecurity mandates, prompting the need for a more inclusive and enforceable directive brought forth with NIS2. The new directive enhances security requirements and implements stricter enforcement measures. This update signifies the EU’s acknowledgment of the increasing cyber threats and the critical need for a unified, robust cybersecurity strategy.

The directive now applies to a wider array of sectors and entities, classified as either “essential” or “important,” based on their significance to the economy and society. This classification includes sectors such as energy, transport, banking, and digital infrastructure, along with new additions like pharmaceutical, food, and digital service providers.

Entities within the directive’s scope are mandated to adopt stringent cybersecurity practices. These include risk management, incident response, supply chain security, and compulsory reporting of significant cyber incidents within defined timelines. The goal is to bolster entities’ capabilities to preempt, detect, and react to cyber threats, thereby reducing potential disruptions to their services and the broader EU market and its citizens.

A key feature of the NIS2 Directive is its focus on timely and detailed incident reporting. Entities are required to follow a structured notification process, promoting transparency and cooperation. This process helps authorities gain insights into the cyber threat landscape, facilitating quicker threat mitigation. This requirement resembles to some degree the new SEC rule, requiring US-traded companies to report material cybersecurity incidents within 96 hours.

The directive also emphasizes governance, requiring entities to appoint senior management roles dedicated to cybersecurity. This ensures the integration of cybersecurity into organizational strategies and accountability at the highest levels.

Furthermore, the directive introduces stricter enforcement actions, including substantial fines for non-compliance. These measures motivate entities to prioritize cybersecurity, aligning with the directive’s overarching objective to enhance the EU’s cyber resilience.

NIS2 Turns the Spotlight to EV Charging

The directive’s specific inclusion of EV charging operators underlines the critical role of EV charging infrastructure in the EU’s sustainable mobility strategy. As EV adoption increases, securing EV charging stations is paramount to maintaining public trust and support for EVs. Stakeholders are encouraged to prioritize cybersecurity, safeguarding against unauthorized access, protecting data privacy, and ensuring infrastructure resilience against cyberattacks.

NIS2: Next Steps for Connected Mobility Stakeholders

With the directive becoming mandatory in October 2024, entities should proactively strive for compliance, embedding cybersecurity deeply into the organizational culture and processes.

• Comprehensive Risk Assessments:
  Identifying specific cybersecurity risks to operations and infrastructure is crucial. This step is foundational in developing an effective cybersecurity strategy, and implementing continuous risk assessment becomes even more important with the increasing use of OTAs and the shift towards SDVs in the automotive ecosystem.
• Enhance SOC Infrastructure:
  Security Operations Centers (SOC) are vital for real-time threat detection and response. Enhancing SOC capabilities is essential to comply with the directive.

Adopting a holistic and proactive cybersecurity approach is imperative for the automotive and smart mobility ecosystem under the NIS2 Directive. As the ecosystem evolves, integrating cybersecurity measures will not only ensure compliance but also protect against the expanding cyber threat landscape.