A guide for laboratories: NIS-2 and what you need to know now

Many laboratories are now part of critical infrastructure

The EU’s NIS-2 Directive (Network and Information Security Directive 2) entered into force in January 2023 and has significant implications for organisations considered part of critical infrastructure, including many laboratories.

What is the NIS-2 Directive?

The NIS-2 Directive succeeds the first EU NIS Directive and aims to strengthen cybersecurity and resilience across the EU. It expands IT security requirements and obliges organisations to improve the security of their systems so they can effectively defend against cyberattacks and other threats.

More organisations are now in scope:

In addition to sectors already covered by NIS-1, such as energy, transport, healthcare, finance, water management and digital infrastructure, the rules cover providers of public electronic communications services, more digital services such as social platforms, wastewater and waste management, manufacturing of critical products, postal and courier services, public administration at central and regional level, and space.

(Source: https://digital-strategy.ec.europa.eu/de/policies/nis2-directive)

Why does the NIS-2 Directive affect laboratories?

Laboratories are environments where numerous instruments, software applications and processes interact, increasing the risk of data loss, theft or tampering. They often have heterogeneous IT infrastructure that includes measuring instruments, enterprise systems such as ERP and CRM, and standard software such as Excel alongside the LIMS. This diversity of interconnected systems greatly increases the attack surface for potential threats .

Affected laboratories must therefore act and prepare for NIS-2 now at the latest: with the adoption of the Directive, data security becomes a legal requirement.

What should laboratories do now?

1. Assess your current security position: Carry out a comprehensive risk assessment and identify vulnerabilities in your IT infrastructure.
2. Train your employees: Human error accounts for a large proportion of security risks, making regular training essential.
3. Review your LIMS and software suppliers: Ensure your current LIMS and software tools meet the NIS-2 Directive’s security requirements. If necessary, contact your provider about required upgrades or adjustments. Ask suppliers to document their information and, where appropriate, insist on independent certification such as ISO 27001.

For an example of this documentation for a LIMS, see our document NIS-2 Annex 3 (classification: public)

Summary

The NIS-2 Directive presents new challenges for laboratories, but also an opportunity to improve IT security sustainably. With LDB, you are well equipped to meet the new requirements while improving your laboratory’s efficiency.

Further information and support:

• On 8 April, Dr. Klinkner und Partner is offering a webinar on NIS-2 for laboratories.
• Further reading: NIS-2 Directive (Directive (EU) 2022/2555)
• Our team is happy to help!
• Contact us now to arrange an individual consultation at office@labordatenbank.de