634 Views No files have yet been downloaded. 0 Citations See all citations Reviewed article Interorganizational Cooperation in Supply Chain Cybersecurity: A Cross-Industry Study of the Effectiveness of the UK Implementation of the NIS Directive

Abstract

The transposition of the EU Directive on Network and Information Security (NIS) by EU Member States involved assigning a set of responsibilities to operators, regulators and policy makers within a national cybersecurity strategy, in order to improve cybersecurity levels across critical infrastructures. This research investigates the perspectives and experiences of organisations affected by the NIS Directive focussing on three different sectors (Energy, Water & Aviation). The authors evaluate the response of different actors to NIS interventions and their challenges in meeting their assigned responsibilities, in particular their ability to oversee supply chain cybersecurity. It proposes further support for partnerships and cooperation across organisations to increase the effectiveness of NIS implementation. Based on results from semi-structured interviews and observations of industry working groups, an approach to supply chain oversight to achieve a balance between control and cooperation is recommended, to improve cybersecurity within industry sectors and across critical national infrastructures. Although our initial focus has been on working mainly with UK stakeholders, we argue that our recommendations have a more general application beyond those countries directly affected by the Directive.

The Opportunity to Regulate Cybersecurity in the EU (and the World): Recommendations for the Cybersecurity Resilience Act

“…This implies strong enforcement, and such enforcement is only possible through similar mechanisms. We therefore clearly recommend national authorities with inspection powers, and requirements for staffing inspired by those from the proposed AI Act 29 , and sanctions which are similar to those that can be given in the GDPR, but with the additional layer of right to ban products on the market which is seen in much product legislation. In addition to this, legacy systems which persist, and radiate a certain risk, should be explicitly tackled by these kinds of powers.…”