The NIS2 Directive adopts a multi-faceted approach to human resources security, placing it within the broader context of cyber risk management. If you want to better understand what the main objective of the NIS2 Directive is, you can learn more in our knowledge base.

Here is an overview of the key elements:

1. Personnel Security as a Risk Management Measure:

• Article 21, Paragraph 2(i): Explicitly lists “human resources security” as one of the essential elements that entities must address in their cyber risk management strategies. This demonstrates a clear recognition of the importance of the human factor for an organization’s overall cybersecurity posture.
• Article 21, Paragraph 1: Requires entities to adopt appropriate technical, operational, and organizational measures to manage cyber risks. This includes human resources security as an integral part of a holistic approach.

2. Specific Requirements Regarding Human Resources Security:

• Training and Awareness (Article 20, Paragraph 2): Mandates that entities provide cybersecurity training to members of management bodies. It is also encouraged to extend similar training to employees to equip them with the knowledge and skills necessary to identify and address cyber risks. This underscores the importance of:
  • Security Awareness: Educating employees on potential threats, such as phishing attacks, and how to mitigate them.
  • Secure Practices: Promoting secure behaviors, such as good password management and recognizing social engineering techniques.
  • Incident Response: Training personnel on how to respond appropriately to security incidents.
• Secure Configuration and Vulnerability Management (Article 21, Paragraph 2): Although not focused exclusively on human resources, these requirements have implications for personnel security:
  • Secure System Configuration: Ensuring that systems are configured securely from the start, potentially limiting the impact of human error or malicious internal activity.
  • Vulnerability Management: Having processes in place to identify, assess, and resolve vulnerabilities, including training for personnel responsible for system maintenance and patching.
• Access Control and Management (Article 21, Paragraph 2(i)): Highlights the importance of “access control policies and asset management“. In the context of human resources security, this likely implies:
  • Principle of Least Privilege: Granting employees access only to the systems and information essential for their role, limiting potential damage from compromised accounts.
  • Strong Authentication: As discussed previously, the use of multi-factor authentication to provide an additional layer of security, particularly for sensitive systems and data.

3. Indirect Implications:

• Supply Chain Security (Article 21, Paragraph 2(d)): Requires entities to address cyber risks within their supply chains. This could extend to the human resources security practices of suppliers and service providers, particularly those with access to critical systems or data.
• Incident Response (Article 21, Paragraph 2(b)): Mandates incident management as a key security element. This likely includes procedures for identifying and responding to security incidents involving personnel, such as insider threats or social engineering attacks. For entities that must also fulfill notification obligations, it is useful to check the rules on the designation of the CSIRT contact person provided by the regulation.

4. Role of Competent Authorities:

• Supervision and Enforcement: The NIS2 Directive empowers national competent authorities to oversee and enforce compliance with the Directive’s requirements. This could involve assessing an organization’s human resources security practices as part of broader cybersecurity audits.

Key Conclusions:

• Holistic Approach: The NIS2 Directive does not treat human resources security as a separate entity, but integrates it into a comprehensive cybersecurity framework.
• Shared Responsibility: While the Directive imposes specific obligations on organizations, it also highlights the importance of employee awareness and training, recognizing shared responsibility in cybersecurity protection.
• Risk-Based Implementation: Entities should tailor human resources security measures to their specific risk profiles and operational contexts. For those needing to structure or verify their compliance journey, our NIS2 Directive compliance service offers operational support from gap analysis to the implementation of required controls. To determine if your organization falls within the mandatory scope, you can also consult the guide on ACN and the list of NIS2 entities.