The NIS 2 Directive
The EU Network and Information Security (NIS) directive was the first piece of EU-wide legislation on cybersecurity that came into force
in 2016. However, to address the limitations identified within the current framework and to respond to the growing cybersecurity threatsin the EU in the wake of digitalization and Covid-19, the European Commission has replaced the NIS Directive with the NIS 2 Directive that
introduces more stringent supervisory measures for national authorities, stricter enforcement requirements and aims at harmonizing
sanctions regimes across Member States. The NIS 2 Directive entered into force on January 16, 2023, and the Member States have 21months, until October 17, 2024, to transpose the directive into national law.
The NIS 2 Directive aims to strengthen security requirements in the EU by expanding its scope to more sectors and entities; taking into
account measures like risk analysis and information system security policies, incident handling, and supply chain security; and streamlining
reporting obligations, among others. In case of non-compliance, NIS 2 requires member states to provide hefty penalties: €10 million or 2% of
global turnover (whichever is higher) for essential entities and €7 million or 1.4% of global turnover (whichever is higher) for important entities.
NIS 2 imposes direct obligations on the management bodies to implement and supervise their organization’s compliance with the legislation.
Non-compliance could potentially lead to the imposition of a temporary ban from discharging managerial responsibilities on the senior
management of the entity, including the C-Suite level executives.
This document outlines how Sophos solutions offer effective tools to support organizations in addressing Chapter IV of the NIS 2 Directive,
Cybersecurity Risk-Management Measures and Reporting Obligations, and eventually help them comply with the NIS 2 Directive.
Specifications and descriptions are subject to change without notice. Sophos disclaims all warranties and guarantees regarding thisinformation. The use of Sophos products alone does not guarantee legal compliance. The information in this document does not constitutelegal advice. Customers are solely responsible for compliance with all laws and regulations and should consult their own legal counsel foradvice regarding such compliance.

NIS 2 Directive - Chapter IV, Cybersecurity Risk-Management Measures and Reporting Obligations
NIS 2 DIRECTIVE REQUIREMENTS

SOPHOS SOLUTIONHOW IT HELPS

Chapter IV, Article 20, Governance
2. Member States shall ensure that the members of Sophos Phish Threat
the management bodies of essential and important
entities are required to follow training, and shallencourage essential and important entities to offer
Sophos Training andsimilar training to their employees on a regular basis,
Certifications
in order that they gain sufficient knowledge andskills to enable them to identify risks and assesscybersecurity risk-management practices and theirimpact on the services provided by the entity.

Provides simulated phishing cyberattacks and security awareness training for theorganization’s end users. Courses cover a wide range of topics from phishing andcybersecurity overview lessons, to data loss prevention, password protection and more.
Training courses and certifications to help partners and customers get the best out of
Sophos security deployments, access to latest know-how and expertise for security bestpractices.

Chapter IV, Article 21, Cybersecurity risk-management measures
Sophos Endpoint
2. Member States shall ensure that essential
and important entities take appropriate andproportionate technical, operational andorganisational measures to manage the risks posedto the security of network and information systems…
Sophos Firewall
based ona) policies on risk analysis and information systemsecurity;

Delivers unmatched protection against ransomware and breaches. Innovative protection
capabilities, including AI-powered deep learning, anti-exploitation, airtight ransomware
protection with automatic rollback, and adaptive defenses that automatically respond toadversaries and stop even the most advanced attacks.
Delivers industry-leading network protection optimized for the modern encryptedinternet and distributed user base. Comprehensive SD-WAN capabilities securely connect
distributed offices and locations while built-in ZTNA delivers secure user-based accessfrom any location.
Sophos Firewall integrates with Sophos Endpoint, Sophos ZTNA, Sophos Switches, andWireless Access Points, as well as Sophos XDR and Sophos MDR to automatically respondto threats, stopping attacks before they can spread. Compromised hosts are automaticallyisolated, preventing lateral movement and external communications until a threat can beinvestigated and cleaned up.

Sophos Managed
Detection andResponse (MDR)

Continuously monitors signals from across the security environment, including network,
email, firewall, identity, endpoint, and cloud technologies, to quickly and accurately detect
and respond to potential cybersecurity events. Proactive threat hunting identifies threats
before they can impact the organization.

2

NIS 2 DIRECTIVE REQUIREMENTS

2. b) incident handling;

SOPHOS SOLUTIONHOW IT HELPS

Sophos Network
Detection andResponse (NDR)

Continuously analyzes traffic for suspicious patterns. It works with Sophos-managed
endpoints and firewalls to monitor network activity for suspicious and malicious patterns.
It detects abnormal traffic flows from unmanaged systems and IoT devices, rogue assets,
insider threats, previously unseen zero-day attacks, and unusual patterns deep within the
network.

Sophos Cloud Optix

Enables organizations to design public cloud environments to meet Amazon Web
Services, Microsoft Azure, and Google Cloud Platform security best practice standards
and maintain them. It continuously monitors and detects drift in configuration standards,
and prevents, detects, and automatically remediates accidental or malicious changes inresource configuration.

Synchronized Security
feature in Sophos
products

Shares telemetry and health status, enabling coordinated isolation, detection, andmalware remediation across servers, endpoints, and firewalls – stopping advanced
attacks.

Sophos Endpoint

Automatically detects and blocks 99.98% of attacks. Provides forensic-level remediation
by eradicating malicious code as well as eliminating nasty registry key changes created bymalware.

Sophos Firewall

Its extensive on-box and cloud-based logging and reporting tools provide actionableinsights to guide and accelerate incident response, including deep intelligence into
network activity and easy log access for forensic analysis. Automated threat response(in collaboration with other Sophos products) reduces response time from minutes toseconds, stopping attacks before they can spread.

Sophos Managed
Detection andResponse (MDR)
Complete

Includes unlimited full-scale incident response as standard, providing 24/7 coveragedelivered by incident response experts. Includes full root cause analysis and reporting. Our
average time to detect, investigate and respond is just 38 minutes.

Sophos Network
Detection andResponse (NDR)

When Sophos NDR identifies an indicator of compromise, active threat, or adversary,
analysts are immediately alerted and can instantly push a threat feed to Sophos Firewall
to trigger an automated response to isolate the compromised host.

3

NIS 2 DIRECTIVE REQUIREMENTS

2. c) business continuity, such as backup
management and disaster recovery, and crisis
management;

SOPHOS SOLUTIONHOW IT HELPS

Sophos XDR

Enables analysts to detect, investigate, and respond to incidents across key attack
surfaces using an organization’s existing security solutions (Sophos and non-Sophos).
Sophos XDR stores 90 days’ security telemetry in the Sophos data lake to facilitate
incident handling, while optimized workflows and AI-powered capabilities accelerate
incident investigation and response.

Sophos Cloud Optix

Scans cloud resources for security misconfigurations, profiling any alerts by risk level tohelp teams focus on the priority areas, and provide detailed remediation guidance to fix
those issues.

Sophos Rapid
Response Service

Enables fast assistance, identifying and neutralizing active threats against yourorganization – delivered by an expert team of incident responders.

Synchronized Securityin Sophos products

Shares telemetry and health status, enabling coordinated isolation, detection, andmalware remediation across servers, endpoints, and firewalls.

Sophos Endpoint

Uses innovative and adaptive security technologies to prevent business disruption,
including AI-powered deep learning, anti-exploitation, and airtight ransomware protection
with automatic rollback.

Sophos Firewall

Sophos Firewall’s plug-and-play high availability (HA) clusters deliver resiliency in theface of business interruption. For improved cost efficiency, customers get active/passive
redundancy while only needing to purchase a license for the active device. Sophos Firewall
also supports multiple internet links with zero impact fail-over and load balancing acrosswireless LTE, cable, DSL, and fiber for maximum resiliency. Extensive logging and onbox and cloud-based reporting provides deep, actionable telemetry to facilitate disasterrecovery.

Sophos Managed
Detection andResponse (MDR)

Mitigates the risk of business disruption with 24/7 detection and response. In the eventof an incident, it includes a full incident response service. Integrations with backup andrecovery vendors enable analysts to identify when adversaries are targeting backups sothey can quickly step in and neutralize the attack. The service stores up to a year’s security
telemetry in the Sophos data lake, facilitating disaster recovery.

Sophos XDRStores 90 days’ security telemetry in the Sophos data lake, facilitating disaster recovery.
Integrations with backup and recovery vendors enable analysts to identify whenadversaries are targeting backups so they can quickly step in and neutralize the attack.

4

NIS 2 DIRECTIVE REQUIREMENTS

SOPHOS SOLUTIONHOW IT HELPS

Sophos Cloud Optix

Identifies where backups are not being taken within public cloud infrastructure accounts
and alerts the security team within the Cloud Optix console to take action.

Sophos Rapid
Response Service

Enables fast assistance, identifying and neutralizing active threats against yourorganization – delivered by an expert team of incident responders.

2. d) supply chain security, including security-related Sophos Endpoint
aspects concerning the relationships between each
entity and its direct suppliers or service providers;

2. e) security in network and information systems
acquisition, development and maintenance,
including vulnerability handling and disclosure;

Delivers comprehensive defense in depth against threats that get in via third-party
suppliers. Protection capabilities include AI-powered deep learning, anti-exploitation,
airtight ransomware protection with automatic rollback, and adaptive defenses that
automatically respond to adversary behaviors.

Sophos Managed
Detection andResponse (MDR)

Delivers expert threat hunting and remediation as a fully managed service. Sophos
specialists work around the clock to proactively hunt for, validate, and remediate potential
supply chain threats and incidents on your behalf. Extensive integrations with security andbusiness solutions used across the organization (including Microsoft and Google) enable
us to see and mitigate threats via your technology supply chain.

Sophos XDR

Enables analysts to detect, investigate and respond to suspicious activity across theirenvironment, helping them see and stop supply chain attacks. Sophos NDR (an add-on
to Sophos XDR) sits deep within the network, monitoring ALL network traffic to identify
threats that other solutions may miss – including from supply chain partners.

Sophos ZTNA

Safeguards against supply chain attacks that rely on supplier access to your systems
via very granular access controls. This cloud-delivered solution validates user identity,and device health and compliance before granting access to resources. It authenticates
requests from trusted partners, irrespective of the location.

Sophos Firewall

Sophos Firewall is ‘Secure by Design,’ and we continually work to make it the most difficult
firewall for adversaries to compromise. It includes:
Ì Best practices built-in to optimize customer security
Ì Hardening against attacks with secure remote management,
containerization, strict access management, MFA and more
Ì Automated hot-fix response with over-the-airupdates to address urgent security issues
Ì Proactive monitoring of the global firewall install base
Ì Robust and transparent vulnerability disclose program,with market-leading bug bounties
5

NIS 2 DIRECTIVE REQUIREMENTS

SOPHOS SOLUTIONHOW IT HELPS

Sophos Managed
Detection andResponse (MDR)

Sophos MDR’s expert analysts monitor alerts from across the network 24/7, investigating
suspicious activities and neutralizing attacks. Sophos NDR sits deep within the network,
monitoring ALL network traffic to identify threats that other solutions may miss.
Sophos MDR proactively responds to vulnerability disclosure by the client. On notification,a full investigation is initiated that looks for signs of exploitation. If necessary, Sophos
MDR will remediate the incident and provide guidance on how to harden the environment
against future exploitation. A full human-authored report is provided in response to thedisclosure investigation.
Sophos Managed Risk is a fully-managed vulnerability management service that
identifies exposures and provides risk-based patching guidance. It collaborates with andcomplements the Sophos MDR service.
Sophos is committed to ‘Secure by Design.’ We have a robust and transparent vulnerability
disclosure program, including safe harbor provisions to support researchers and marketleading bug bounties.

Sophos XDR

Enables analysts to monitor alerts from across the network 24/7, investigating suspicious
activities and neutralizing attacks. Sophos NDR (an add-on to Sophos XDR) sits deep
within the network, monitoring ALL network traffic to identify threats other solutions may
miss.

Sophos Cloud Optix

Scans cloud resources for security misconfigurations, profiling any alerts by risk level tohelp teams focus on the priority areas, and provide detailed remediation guidance to fix
those issues.

Sophos Rapid
Response Service

Get fast assistance, identifying and neutralizing active threats against your organization –delivered by an expert team of incident responders.

6

NIS 2 DIRECTIVE REQUIREMENTS

SOPHOS SOLUTIONHOW IT HELPS

2. f) policies and procedures to assess theeffectiveness of cybersecurity risk-management
measures;

Sophos Endpoint

Built-in health check enables organizations to quickly identify and address configuration
issues with their Sophos-protected devices. Should an issue be identified, the ‘Fix
Automatically’ option enables users to address insecure configurations in just a few clicks.

Sophos Firewall

Built-in posture reports enable organizations to quickly assess their network security
deployment and identify areas for optimization.

Sophos Managed
Detection andResponse (MDR)

Investigates and assesses potential security risks across the full environment 24/7,
leveraging world-leading threat intelligence from Sophos X-Ops to identify risk levels andprioritize response.

Sophos Phish Threat

Provides simulated phishing cyberattacks and security awareness training for theorganization’s end users. Courses cover a wide range of topics , from phishing andcybersecurity overview lessons to data loss prevention, password protection, and more.

Sophos Training andCertifications

Training courses and certifications to help partners and customers get the best out of
Sophos security deployments, access to latest know-how and expertise for security bestpractices.

Sophos Firewall

Facilitates MFA for VPN connections, with granular RADIUS/TACACS integration. The
Sophos Cryptographic Module incorporated into the Sophos Firewall systems provides
FIPS 140-2 validated cryptography for the protection of sensitive information.

Sophos Email

Sophos SPX encryption provides encryption in transit and at rest. SPX encryption is able todynamically encapsulate email content and attachments into a secure encrypted PDF toensure compliance.

Sophos WirelessCreates dynamic encrypted Wi-Fi sessions, protecting information in transit on Sophosmanaged networks and hotspots.

2. g) basic cyber hygiene practices andcybersecurity training;

2. h) policies and procedures regarding the use of
cryptography and, where appropriate, encryption;

7

NIS 2 DIRECTIVE REQUIREMENTS

SOPHOS SOLUTIONHOW IT HELPS

2. i) human resources security, access control
policies and asset management;

Sophos Firewall

User awareness across all areas of our firewall governs all firewall policies and reporting,giving user-level controls over applications, bandwidth, and other network resources.
Built-in ZTNA delivers secure user-based access from any location. Role-based admin
controls, multi-factor authentication, and granular access controls are also included.

2. j) the use of multi-factor authentication orcontinuous authentication solutions, secured
voice, video and text communications and secured
emergency communication systems within theentity, where appropriate

Sophos Managed
Detection andResponse (MDR)

Threat-hunting experts monitor and correlate information system activity across the fullIT security environment, identifying and investigating suspicious activities by regularly
reviewing records of information system activity, including relating to HR system, access
control and assets.

Sophos XDR

Enables analysts to monitor and correlate information system activity across the fullsecurity environment, identifying and investigating suspicious activities, including thoserelating to HR systems, access control and assets.

Sophos Central

Keeps access lists and user privileges information up to date. Procedures are in place
to ensure that access rights are revoked if individuals no longer meet the conditions toreceive access (e.g., because they change position or leave the company).

Sophos Cloud Optix

Facilitates inventory management across multiple-cloud providers with continuous asset
monitoring and complete network topology and traffic visualization.

Sophos ZTNA

Enables better security and more agility in quickly changing environments by making it
quick and easy to enroll or decommission users and devices. Continuously validates user
identity, device health, and compliance before granting access to applications and data.

Sophos Firewall

Supports flexible MFA authentication options including role-based admin controls, anddirectory services for access to key system areas. Built-in ZTNA continuously validates
user identity, device health, and compliance before granting access to applications anddata. Granular access controls are also integrated into Sophos Firewall to govern access.

Sophos Central

Protects privileged and administrator accounts with advanced two-factor authentication.

Sophos Cloud Optix

Monitors AWS/Azure/GCP accounts for Root user and IAM user access with MFA disabled
so you can address and ensure compliance.

Sophos ZTNA

Continuously validates user identity, device health, and compliance before granting
access to applications and data.

8

The NIS 2 Directive

NIS 2 DIRECTIVE REQUIREMENTS

SOPHOS SOLUTIONHOW IT HELPS

Sophos Managed
Detection andResponse (MDR)

Includes full incident response and root cause analysis. Sophos experts remediate theincident and provide a full human-authored report that includes detailed analysis of how
the attack occurred together with guidance on how to harden the environment against
future exploitation.

Sophos XDR

Enables analysts to identify and report on the full attack chain, including a detailed
description of the incident and the root cause of the attack.

Sophos Managed
Detection andResponse (MDR)

Includes full incident response and root cause analysis. Sophos experts remediate theincident and provide a full human-authored report that includes detailed analysis of how
the attack occurred together with guidance on how to harden the environment against
future exploitation.

Sophos XDR

Enables analysts to identify and report on the full attack chain, including a detailed
description of the incident and the root cause of the attack.

Chapter IV, Article 23, Reporting obligations
4. Member States shall ensure that, for the purposeof notification under paragraph 1, the entities
concerned submit to the CSIRT or, where applicable,
the competent authority:d) a final report not later than one month after thesubmission of the incident notification under point(b), including the following:(i) a detailed description of the incident, including its
severity and impact;
4. Member States shall ensure that, for the purposeof notification under paragraph 1, the entities
concerned submit to the CSIRT or, where applicable,
the competent authority:d) a final report not later than one month after thesubmission of the incident notification under point(b), including the following:(ii) the type of threat or root cause that is likely tohave triggered the incident;© Copyright 2024. Sophos Ltd. All rights reserved.
Registered in England and Wales No. 2096520, The Pentagon, Abingdon Science Park, Abingdon, OX14 3YP, UK
Sophos is the registered trademark of Sophos Ltd. All other product and company names mentioned aretrademarks or registered trademarks of their respective owners.
2024-08-26 (WP-NP)