\u201cThe increasing degree of digitalization and interconnectedness, along with the rising number of cyber malicious activities at the global level, has effectively rendered cybersecurity an increasingly valued position on a business level. In the U.S., beyond the FDA\u2019s efforts that address medical devices,1<\/sup> the Securities and Exchange Commission’s agenda for 2023 includes the implementation of a new rule on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure requiring companies subject to the Securities Exchange Act of 1934 to report material cybersecurity incidents within a certain timeframe and make disclosures pertaining to the company’s cybersecurity protocols and risk management strategies.2<\/sup><\/p>\n\n\n\n In the European Union, however, the cybersecurity mandate is not limited to publicly traded organizations since a new cybersecurity directive was published and entered into force on Jan. 16, 2023. This new Directive (EU) 2022\/2555 on the Security of Network and Information Systems3<\/sup> (\u201cNIS2\u201d) mandates cybersecurity risk management measures and reporting requirements for all segments of our industry:<\/p>\n\n\n\n You may consider NIS2 comparable to EU GDPR \u2014 NIS2 looks to protect economic data akin to GDPR protecting personal data. Together, let\u2019s further explore the necessary requirements set by NIS2 that need to be addressed:<\/p>\n\n\n\n NIS2 places increased demands on internal cybersecurity risk management. It is important that your organization carries out risk analyses, which act as preventive measures against security threats. Your organization must ensure that it has security measures in place that reduce the consequences and risks of cybersecurity incidents. As part of reducing the consequences of cyber incidents, you must also have a plan for how it will ensure business continuity if your organization is hit by a cyberattack. This includes a plan for the deployment of a crisis team, emergency procedures, and recovery of the affected systems. A NIS2 core requirement is that organizations take the appropriate and proportionate technical, operational, and organizational measures according to the state of the art. The expected starting point is the systematic analysis that considers and evaluates the human factor and the degree of dependency on network and information systems, and the following measures are the minimum requirements to be covered:<\/p>\n\n\n\n The overarching agency to oversee NIS2 is The European Union Agency for Cybersecurity (ENISA), but the enforcement will depend on each country. Who issues the fines, who files injunctions, who collects the fines, who removes management from their roles, etc., will be your local regulatory authority.<\/p>\n\n\n\n Covered entities, whether laboratories, CROs and CDMOs, or pharmaceutical or medical device manufacturers, will be subject to active supervision, akin to an FDA consent decree oversight. The supervision will be risk-based, and this can be done on-site, through audits, reporting, peer reviews and security scans, or remotely, and the regulatory agencies can request information and data from your systems to assess whether you have the appropriate security measures in place, or had them in place, to protect your data.<\/p>\n\n\n\n If the regulatory agency does not believe that your organization complies with NIS2 requirements, it can issue a court order requiring your organization to rectify the lack of security. If the lack of compliance is severe enough or the organization does not adequately or timely address the non-compliance, then fines would be levied.<\/p>\n\n\n\n Of interesting note, however, is that NIS2 presents a significant impact on management’s responsibility to ensure companies meet its requirements. There is an explicit expectation for senior management to focus on and manage the company’s cybersecurity risks, and executives could be deprived of their managerial powers in the event of non-compliance. In parallel, product certifications or approvals may be suspended.<\/p>\n\n\n\n Organizations must have in place procedures and mechanisms to ensure timely and accurate reporting of cybersecurity incidents to the relevant authorities within 24 hours, and a final incident written report is submitted within one month. The importance of incident reporting is reflected in tight deadlines and an organization can be subject to sanctions if it does not comply. So, entities must report any incident that caused or has the potential to cause<\/em> substantial operational disruption or financial losses for the entity concerned, has affected or has the potential to affect <\/em>other natural or legal persons by causing considerable material or non-material losses, or for which there is an indication it was presumably caused by unlawful or malicious action.<\/p>\n\n\n\n NIS2 obliges covered entities to adopt a risk-based approach to cybersecurity and extend it to your entire supply chain. As such, you must conduct a cybersecurity due diligence throughout your supply chain. This applies both to products (software bill of materials) and cybersecurity requirements that suppliers have. In essence, a covered entity is not only responsible for the cybersecurity of its own operations but also the suppliers it chooses to use.<\/p>\n\n\n\n Most organizations often lack a management-based strategy for cybersecurity, a common frame of reference, and a general understanding of how cyber risks must be articulated and managed \u2013 technically, operationally, and organizationally as well as financially and contractually. It is expected that the task of raising the cybersecurity level within an organization will be difficult and expensive.<\/p>\n\n\n\n A robust cybersecurity strategy should protect your company\u2019s assets and activities and ensure continuous compliance with NIS2. The assets and activities can be both physical and intangible assets, such as confidentiality, people, processes, reputation, regulation, contractual obligations, etc., and the basic prerequisite for drawing up the strategy is to have a clear picture of:<\/p>\n\n\n\n The aim of such a cybersecurity strategy is to frame the operational elements to identify, protect, detect, manage, and recover and, thereby, correspond to internationally recognized cybersecurity frameworks.\u201d<\/p>\n\n\n\n Please find the complete paper here<\/strong><\/a>.<\/p>\n\n\n\n Topics<\/strong>: #healthcare #lifeSciences #medicaldevices #medtech #medicaltechnology #MedSysCon #FDA #EU #Cybersecurity<\/p>\n\n\n\n For further information please get in touch with us:<\/p>\n\n\n\n\n
\n
Cybersecurity Risk Management And Governance<\/h2>\n\n\n\n
\n
\n
Regulatory Oversight And Enforcement<\/h2>\n\n\n\n
Incident Reporting<\/h2>\n\n\n\n
Supply Chain<\/h2>\n\n\n\n
Considerations<\/h2>\n\n\n\n
\n
<\/h2>\n\n\n\n
References<\/strong><\/h2>\n\n\n\n
\n
=active&agencyCd=3235&csrf_token=57EAE6361828696D77A089ABEC320A1193B2BD5D273
12F60466BF8BF333312C93FB346B2352B6C7619757176AE5CCB48D4B0<\/a><\/li>\n\n\n\n
![\"\"](\"https:\/\/www.medsyscon.com\/wp-content\/uploads\/2020\/02\/Logo_MedSysCon_Medizintechnik_4C-1024x254.jpg\"){kind=logo}
<\/figure>\n","protected":false},"excerpt":{"rendered":"