Why is it that in some companies leaders and managers in the field of HR are the ones taking the first steps to involve external experts in the preparation for NIS2 (Network and Information Security V2)? The answer is inherent in the fact that HR may actually have a lot to offer in this maze of information security. In the following, we will attempt to answer this question based on the experiences of our NIS2 mentoring service so far.

Information security is not an internal matter (only) for IT

The NIS2 (Network and Information Security V2) Directive is about protecting both infrastructure and information.

Make no mistake: in spite of the fact that in the transposition of the EU directive into Hungarian law, the title of the Act transposing the NIS2 directive uses only the word “cybersecurity,” ultimately NIS2 is still about information security also in Hungary.

Cybersecurity is the “art” of countering attacks from cyberspace, while information security is a highly regulated, conscious and professional set of procedures for controlling and storing data in the possession of a company. Cybersecurity is a very important part of this, but it is only a slice of information security.

Information security neither starts nor ends with IT. The latter is, of course, a very important component, but at the moment humans are still at the heart of information security. Even with the best intentions, people are still considered among the weakest points in the line of defence.

Those “socialised” on GDPR rules

If one had to name a piece of legislation specifically designed to protect information in the European Union, GDPR would be the first thing that would come to mind almost without exception. No wonder, as every company that handles personal data, such as keeping records on employees or individual customers, has had to familiarise itself with the General Data Protection Regulation, since 25 May 2018.

Because personal and sensitive data are typically significantly overrepresented in HR processes and tools compared to other business processes, the GDPR has had a significant impact on the daily operations of HR departments for years.

Most HR departments are already familiar with the requirements of GDPR, and have incorporated them into the day-to-day operations of the company.

Even though NIS2 is not the new GDPR, it is no wonder that with the experience of GDPR, some HR teams are the first to understand and recognise the importance of the new requirements related to information protection and the first to become curious about the challenges of complying with them.

Thinking organisationally

Companies can only understand and translate the NIS2 requirements to their own situation if they treat it as an information security management system that transcends organisational units. It is very difficult,  and in many cases even impossible, to delegate information security measures and their operation to a single department.

Often, a modern and well-functioning HR team will have a higher level of organizational thinking and a greater need to break down organizational silos than a traditional IT department.

From this point of view, it may seem quite logical and justified that in many cases the HR teams take the initiative in understanding the NIS2 requirements more precisely.

However, this does not mean that HR colleagues feel ready to take on NIS2 challenges on their own, equipped with the necessary knowledge and experience. Instead, they prefer to assume a coordinating role between IT, internal business process owners and a possible external consulting partner.

And then there are the trainings

It cannot be stressed enough that although NIS2 is a fundamentally technological set of requirements, the human side of information security should not be overlooked either.

Even with the most carefully designed processes and software, developed to near perfection, mistakes made by staff or managers pose a huge threat to information security, and this is unlikely to change in the future.

One of the chapters of the NIS2 requirements specifically addresses training and the need to continuously improve security awareness in companies, both at individual and organisational level. The continuous and effective training of colleagues in this area, and especially the organisation of “cyber hygiene” exercises, should be the responsibility of HR, which is often best placed to deliver effective and efficient training in a company.

We are not claiming that a dedicated HR team is the ideal player to coordinate NIS2 preparation for every company, but it is almost certain that a proactive and prepared HR department can do much to ensure that the complex requirements of NIS2 have the least negative impact on the existing organisational culture.