Cybersecurity has become a pressing concern, particularly for organizations operating critical infrastructures. With the advent of the NIS-2 Directive backed by the European Union, cyber resilience is being prioritized more than ever. Saxony, Germany, has taken proactive steps by integrating this directive into its Saxon Information Security Act, enacted on June 12, in a bid to enhance cybersecurity across various sectors.
The NIS-2 Directive, which stands for Network and Information Security, aims to bolster cyber defenses within EU member states. This initiative targets critical infrastructure sectors like healthcare, utilities, banking, public transportation, service providers, and manufacturers—altogether totaling 18 identified sectors. With this broader classification, the pressing challenge for Saxony lies in recruiting IT professionals to manage these new security measures, given the current scarcity of qualified personnel.
Crafting a Custom IT Security Plan
"Most companies will need support. And the sooner they address the issue, the better," advises Christian Müller, a technical consultant at SHD System-Haus-Dresden GmbH. Effective cybersecurity requires a tailored approach, not just off-the-shelf solutions.
SHD is expanding its service offerings and seeking additional employees
Typically, this process begins with an inventory assessment and penetration tests to identify system vulnerabilities. The findings inform the development of robust defenses to protect sensitive data and prevent business operations from being compromised. As Müller points out, proactive measures are key to prevention.
Preparing for Increased Demand
Anticipating the heightened demand for cybersecurity expertise, SHD is expanding its service offerings and seeking additional employees. "Anyone wanting to gain a foothold in the industry currently has excellent opportunities," notes Müller. NIS-2's implementation will diversify the scope of tasks for IT professionals, especially in sectors with complex requirements.
Marco Graef, Managing Director of SHD, emphasizes the importance of technical expertise and infrastructure. "Since we have been an IT service provider for clients with critical infrastructures for many years, the new regulation is not uncharted territory for us," he asserts. SHD ensures its staff remains adept through continuous training and certifications, some officially sanctioned by the German Federal Office for Information Security (BSI).
BSI-Certified Incident Response
The NIS-2 directive promises to strengthen the security framework in Europe
SHD's preparation extends to DIRT, or the German Incident Response Team, incorporating 50 BSI-certified experts among its 4,500 IT professionals. Marco Graef, a key figure in this network, underscores the long-term objective of elevating Germany's cybersecurity standards.
While the NIS-2 directive's enforcement is not immediate, businesses must plan strategically. "The implementation of the directive will likely only be reviewed after three years," Müller states. Companies should strive to align with compliance requirements to avoid future setbacks and ensure resilience against cyber threats.
The NIS-2 directive promises to strengthen the security framework in Europe. However, it also highlights the continued challenge posed by skilled worker shortages, throwing into sharp relief the need for a capable IT workforce to manage these complex obligations effectively.
There are topics that everyone can relate to – at least on the surface. But what exactly lies behind them, who is affected and in what way, often raises questions even where one should know better. Cybersecurity in the workplace is one such topic. It's no secret that companies are hacked and that spam emails can turn out to be phishing attacks.
But how should companies protect themselves effectively? How much cybersecurity does a metalworking company need, how much a grocery store, a doctor's office, or a government agency? These questions are difficult for managing directors or department heads to answer today.
And the topic is becoming increasingly complex, because Saxony is the first German state to take a step forward in implementing European regulations to increase cybersecurity. With a resolution passed by the Saxon State Parliament on June 12, the European legal requirements of the so-called NIS-2 Directive are enshrined in the Saxon Information Security Act.
Who belongs to the critical infrastructure?
The acronym NIS stands for Network and Information Security. The directive aims to improve cyber resilience in the member states of the European Union. The focus is on critical infrastructure, meaning those sectors essential for maintaining normal daily life. This includes hospitals, utilities, banks, public transport companies, as well as service providers and manufacturers. With the new directive, more sectors than before are now considered critical infrastructure; a total of 18 sectors are distinguished.
The requirements regarding the size threshold at which a company must implement special security measures have also changed. For Saxony, the very real question now is where to find the professionals who will handle the implementation of NIS 2 in companies and public administrations. The job market for IT specialists is already extremely tight. It is unlikely that any company will be able to meet the security requirements of the future with its existing resources.
Tailored IT security concept
“Most companies will need support. And the sooner they address the issue, the better,” says Christian Müller. As a technical consultant at the Dresden-based IT service provider SHD System-Haus-Dresden GmbH, he is familiar with the vulnerabilities in businesses and public administrations. And he knows that a tailored IT security concept requires thorough analysis and planning. Not every expensive and supposedly perfect all-inclusive package is suitable for every company.
He and his colleagues typically begin with an inventory assessment during a short workshop and a penetration test. In this test, the professionals attempt to crack the company's security system. Sometimes it's a matter of a few hours, sometimes a task that takes days. Ultimately, however, the results always reveal the vulnerabilities that cybercriminals could exploit to steal internal company data or even cripple the entire business. After the initial shock, a concept is developed collaboratively to prevent precisely this worst-case scenario.
Which companies need to take action?
One thing is certain: the demand for professional help will increase in the coming months. SHD is prepared for this and already has a broad base of services. However, they are also looking for new employees.
"Anyone wanting to gain a foothold in the industry currently has excellent opportunities," says Christian Müller. Not least due to NIS 2, the range of tasks for IT professionals will expand even further. Those who work for an experienced service provider quickly learn the requirements of various industries and administrative structures.
Information security consultants
“Since we have been an IT service provider for clients with critical infrastructures for many years, the new regulation is not uncharted territory for us. When you're an IT service provider for university hospitals or government agencies operating far beyond the state level, you're talking about in-depth technical expertise. This expertise resides not only in the minds of our specialists but also in the technical infrastructure, particularly in conjunction with IT security processes. We have invested heavily in this area in recent years,” says Marco Graef, Managing Director of SHD.
Graef himself has decades of experience in the architecture of data centers and critical IT infrastructures and is therefore well-positioned to assess the current challenges. The IT forensic experts and information security consultants themselves invest significantly to stay up-to-date. This includes independent certifications, training courses directly with the Federal Office for Information Security (BSI), and annual recertifications.
BSI-certified incident experts
“We respect the high demand, but feel well prepared. We've been preparing for this for years,” said Marco Graef, also referring to DIRT. The German Incident Response Team is a network of companies with 50 BSI-certified incident experts and a total of 4,500 IT professionals. Dirk Henniges, Managing Director of the Compass Group , along with the 15 managing directors from the network, has made it their mission to raise cybersecurity in Germany to the highest level in the long term. Marco Graef is one of them.
What ultimately presents an exciting challenge for security specialists is likely causing considerable concern for many business owners between the Neisse and Vogtland regions. And rightly so, but expert Christian Müller warns against hasty, desperate measures.
Suitable security concept
"The implementation of the directive will likely only be reviewed after three years. So there's still plenty of time to develop a suitable security concept. However, it's crucial that the affected companies register accordingly as soon as possible," he says.
Those who do their homework regarding NIS 2 now have a good chance of successfully passing the audit – the review by external experts – and, more importantly, being well protected. The number of cyberattacks has been rising for years. According to statistics from the Federal Criminal Police Office (BKA), attacks originating from abroad alone increased by 28 percent last year, causing damage totalling more than 200 billion euros.
Skilled worker shortage
The implementation of the NIS-2 directive will "further tighten the security net," according to a statement from the Saxon State Chancellery. The state's information security officer will now also assume the role of a supervisory authority. He will be responsible for monitoring the implementation of security measures and reporting security incidents in key government agencies to the European Union.
Greater security for everyone – that's something everyone should be interested in. But for companies, NIS 2 also represents another challenge, one that once again vividly illustrates the practical consequences of the skilled worker shortage.
