NIS-2: 10 common misconceptions about the regulation

We wrote here about NIS2 and we will continue to add more content about it.

Because we are getting closer to October 17th, many people are getting more and more nervous about NIS2.

Despite its significance, there are numerous misconceptions and misinterpretations circulating about the scope and implications of this regulation.

This article aims to clarify some of the misconceptions,  which I collected mostly from LinkedIn and articles about NIS-2.



“NIS2” and “NIS-2” are exactly the same thing. I am using both in this article only because of SEO.



1. NIS2 starts being applied in the EU starting 17.10.2024

Truth is that the regulation is already applicable in the EU since it was approved. This deadline applies to the individual countries of the EU to convert and apply the NIS2 requirements in local laws.

If national authorities fail to properly implement EU laws, the Commission may launch a formal infringement procedure against the country in question. If the issue is still not settled, the Commission may eventually refer the case to the Court of Justice of the European Union.


2. Limited scope of application

Contrary to the belief that NIS-2 only applies to large tech companies, the directive significantly broadens its scope compared to its predecessor, NIS.

NIS-2 extends beyond just critical infrastructure sectors like energy and transport, encompassing a wide array of sectors such as digital services, public administration, and healthcare.

It mandates a security and incident reporting framework that applies to both Essential and Important Entities, significantly expanding the list of sectors and services affected.

3. NIS-2 Is Just About Cybersecurity

While cybersecurity is a core component, NIS-2 is not merely about preventing cyberattacks. The directive emphasizes a comprehensive approach to security, which includes resilience against a wide range of threats.

This includes but it is not limited to:

  • supply chain security,
  • incident response, and
  • crisis management.

It establishes a baseline for security measures and incident notifications that entities must adhere to, ensuring a uniform level of security across member states.

4. NIS-2 compliance is the same across all EU countries

Although NIS-2 sets a framework for cybersecurity across the EU, member states have some flexibility in implementation. This means that there can be variations in how directives are enforced from one country to another, depending on local laws and regulations.

Companies operating across multiple jurisdictions need to be aware of and comply with local variations to ensure full compliance.

5. Heavy penalties are the main compliance driver

While it is true that NIS-2 can impose hefty fines for non-compliance, focusing solely on penalties misses the broader objective of the directive.

NIS-2 is designed to cultivate a culture of security and resilience. It encourages entities to proactively manage their cybersecurity risks and to collaborate with national authorities.

This cooperative approach is fundamental to enhancing the overall cybersecurity posture of the EU.

6. NIS-2 does not affect third-party suppliers

NIS-2 places explicit requirements on the security practices of third-party suppliers. Entities covered under the directive are required to ensure that their supply chains are secure.

This includes mandatory risk assessments and incident reporting requirements that extend to service providers, reflecting an understanding that security is only as strong as the weakest link in the supply chain.


7. NIS-2 contains rules for AI, IoT, Industry 4.0.

NIS-2 sets a framework for cybersecurity and it does not address anything in particular. However, the rules described can be very well applied to companies in the fields like those mentioned that fall under the regulation applicability.

The companies active in Digital Infrastructure Services (Internet Nodes, DNS Service Providers, TLD Registries, Cloud Providers, Data Centers, Content Delivery Networks, Trust Services, Communication Networks, Communication Services ) and in

ICT Service Management (B2B only) (Managed Services (IT, Networks/Infrastructure, Applications), Managed Security Services (Risk and Cyber Security) ) are potentially directly affected by the regulation. However, there are clear criteria about which companies are affected.


8. Any company with activity in the domains marked as Important and Essential is affected by NIS-2

Although the domains are under the NIS-2 regulation, a company is affected if it meets the criteria:

  • Essential Entities (EE):
    • at least 250 employees and
    • 50 Mil € revenue
  • Important Entities (IE):
    • at least 50 employees and
    • 10 Mil € revenue

If a company doesn’t have these characteristics, then, in general, it is not affected by the regulation directly. It is highly recommended that even in such cases the companies follow the regulation’s requirements, since it will increase their resilience against cyber attacks.

However, an entity may still be considered “essential” or “important” even if it does not meet the size criteria, in specific cases such as when it is the sole provider of a critical service for societal or economic activity in a Member State.


9. All affected companies must certify for NIS-2

A the time of writing this post there is no certification for NIS-2. This might change in the future, especially when because we don’t know at this time how the regulation will be implemented in each of the EU member states.

There are consulting companies that sell consulting services and guarantee that a company will get the “NIS-2  certification” if they bus their services. While buying consulting is in general a good thing, the only thing that can be obtained is help in meeting the requirements of the regulation.

I recommend to stay away from offers that promise things that don’t exist.


10. Companies can buy software/hardware products to become conform with NIS-2

Although conformity is sometimes made easier by using specialized software and hardware products, there is no requirement or recommendation to purchase anything.

Some security providers and consulting companies are offering On The Shelf  (OTS) products that promise immediate conformity with NIS-2 (or guarantee obtaining a “certification” – see point 9 above).

If you look at the series of articles in the NIS2 area of this website, you will see that actually quite a lot of  steps involve an ISMS, a cybersecurity framework, cybersecurity products and so on.

These can be implemented with commercial or open source products, but there is still need to know where and how to install them in order to become conform.

I can very well imagine that there will be soon commercial offerings with sets of templates for implementing the NIS-2 requirements, just like there are with ISO 27001, TISAX and other certifications.

The post NIS-2: 10 common misconceptions about the regulation first appeared on Sorin Mustaca on Cybersecurity.

Understanding ISO 27001:2022 Annex A.8 – Asset Management


ISO 27001:2022 Annex A.8, “Asset Management,” addresses the importance of identifying, classifying, and managing information assets within an organization. This annex emphasizes the need for organizations to establish processes for inventorying assets, assessing their value, and implementing appropriate controls to protect them. In this technical educational article, we’ll explore how to implement Annex A.8 in practice, highlight its significance, and discuss the audit process for assessing compliance.





What is an Asset ?

In the context of ISO 27001:2022, an asset refers to anything that has value to an organization and needs to be protected.

This includes not only tangible assets such as

  • Physical assets:
    • hardware and equipment
    • buildings
    • vehicles
  • People
    • Employees
    • Customers
    • Suppliers
  • Software
  • Intangible
    • Data
    • Intellectual property
    • Proprietary information
    • Reputation
    • Market Share

ISO 27001:2022 recognizes that assets come in various forms and play a crucial role in achieving an organization’s objectives.

What makes an asset worth to be added to the list?

Here are some key points to consider regarding assets in the context of ISO 27001:2022:

  1. Identification: Organizations need to identify and inventory all their assets, including both tangible and intangible ones. This involves understanding what assets the organization possesses, where they are located, and who has ownership or responsibility for them. If this can be done, then the asset is worth enough to be considered to be managed.
  2. Classification: Assets should be classified based on their value, sensitivity, and criticality to the organization. This classification helps prioritize protection efforts and allocate resources effectively. For example, sensitive customer data may be classified as high-value assets requiring stringent security measures. If an asset is classified with a category that makes it important for the company, then it should be definitely managed.
  3. Risk Management: Assets are subject to various risks, including cybersecurity threats, natural disasters, and human error. Organizations need to conduct risk assessments to identify and mitigate threats to their assets effectively. This involves evaluating the likelihood and potential impact of risks and implementing controls to reduce risk to an acceptable level.
  4. Protection: Based on the risk assessment for an asset, organizations must implement appropriate controls to protect their assets from unauthorized access, disclosure, alteration, or destruction. This includes measures such as access controls, encryption, backup procedures, and physical security measures. Based on the measures identified, an asset can be quite expensive to be protected, but losing it or damaging it might prove to be even more expensive.


Importance of Asset Management

Effective asset management is crucial for organizations to safeguard their information assets, optimize resource allocation, and mitigate risks. Annex A.8 underscores this importance by:

  1. Risk Reduction: Identifying and classifying information assets helps organizations prioritize security measures and allocate resources effectively to mitigate risks.
  2. Compliance: Maintaining an accurate inventory of assets and implementing appropriate controls ensures compliance with regulatory requirements and industry standards.
  3. Cost Savings: Efficient asset management practices enable organizations to optimize resource utilization and avoid unnecessary expenses associated with redundant or underutilized assets.

Implementing Annex A.8 in Practice

To effectively implement Annex A.8, organizations can follow these practical steps:

  1. Asset Identification: Begin by identifying all information assets within the organization, including hardware, software, data, and intellectual property. Establish criteria for identifying assets, such as ownership, criticality, and sensitivity.Example: Develop an asset inventory list categorizing assets based on their type, location, owner, and importance to business operations.
  2. Asset Classification: Classify information assets based on their value, sensitivity, and criticality to the organization. Define classification levels or categories to differentiate between assets requiring different levels of protection.Example: Classify data assets as public, internal use only, confidential, or restricted based on their sensitivity and impact on the organization if compromised.
  3. Asset Ownership: Assign ownership responsibilities for each information asset to designated individuals or departments within the organization. Clearly define roles and responsibilities for managing and protecting assigned assets.Example: Assign data ownership responsibilities to business units or functional departments responsible for creating, accessing, or managing specific types of data.
  4. Risk Assessment: Conduct risk assessments to identify threats, vulnerabilities, and potential impacts on information assets. Assess the likelihood and impact of potential risks to prioritize mitigation efforts.Example: Perform a vulnerability assessment to identify weaknesses in IT systems and applications that could expose information assets to security threats.
  5. Control Implementation: Implement appropriate controls to protect information assets from unauthorized access, disclosure, alteration, or destruction. Select controls based on the results of risk assessments and compliance requirements.Example: Implement access control mechanisms, such as user authentication, role-based access control (RBAC), and encryption, to safeguard sensitive information assets from unauthorized access.

Audit of Compliance with Annex A.8

Auditing compliance with Annex A.8 is essential for evaluating an organization’s adherence to asset management requirements. Here’s how the audit process typically unfolds:

  1. Audit Preparation: The organization gathers documentation related to asset management policies, procedures, and controls. An audit team is appointed to facilitate the audit process.
  2. Audit Planning: The audit team defines the audit scope, objectives, and criteria. They develop an audit plan outlining the audit activities, timelines, and responsibilities of auditors and auditees.
  3. On-site Audit: Auditors conduct on-site visits to assess the implementation of asset management controls. They review documentation, interview personnel, and observe asset management practices in action. Auditors may use checklists or standardized assessment tools to evaluate compliance.
  4. Audit Findings: After the on-site audit, auditors analyze their findings and identify areas of non-compliance or improvement opportunities. They document their observations, including strengths and weaknesses in the organization’s approach to asset management.
  5. Reporting: Auditors prepare an audit report summarizing their findings, conclusions, and recommendations for corrective actions. The report is shared with senior management and relevant stakeholders for review and action.
  6. Follow-up: Management addresses audit findings by implementing corrective actions and improvements as recommended. Follow-up audits may be conducted to verify the effectiveness of corrective measures and ensure ongoing compliance with Annex A.8 requirements.


ISO 27001:2022 Annex A.8 highlights the importance of asset management in safeguarding information assets and mitigating risks. By implementing robust processes for identifying, classifying, and managing information assets, organizations can optimize resource allocation, ensure compliance, and enhance their security posture. Regular audits help assess compliance with Annex A.8 requirements and drive continuous improvement in asset management practices. Prioritizing asset management is essential for organizations seeking to protect their valuable information assets and maintain trust in their operations.

The post Understanding ISO 27001:2022 Annex A.8 – Asset Management first appeared on Sorin Mustaca on Cybersecurity.

Understanding ISO 27001:2022 Annex A.6 – Organization of Information Security

We started the ISO 27001:2022 series with the promise of explaining how the 14 categories of controls can be implemented.

We start today with ISO 27001:2022 Annex A.6, “Organization of Information Security”, which outlines requirements for establishing an effective management framework to govern information security within an organization. This annex emphasizes the importance of defining roles, responsibilities, and processes to ensure the confidentiality, integrity, and availability of information assets.

In this technical educational article, we’ll explore how to implement Annex A.6 in practice and elucidate the audit process for assessing compliance.


Importance of Organization of Information Security

A well-organized approach to information security is essential for maintaining the confidentiality, integrity, and availability of organizational assets. Annex A.6 helps organizations achieve this by:

  1. Defining Responsibilities: Clearly delineating roles and responsibilities ensures accountability for information security tasks across the organization.
  2. Establishing Processes: Formalizing processes for risk management, incident response, and access control streamlines security operations and enhances responsiveness to security incidents.
  3. Ensuring Compliance: Implementing a structured framework for information security governance helps organizations meet regulatory and compliance requirements.

Implementing Annex A.6 in Practice

To effectively implement Annex A.6, organizations can follow these practical steps:

  1. Define Information Security Roles and Responsibilities: Identify key stakeholders responsible for information security governance, including senior management, IT personnel, data owners, and end-users. Clearly define their roles and responsibilities in safeguarding information assets.Example: Establish a Security Steering Committee comprising senior management representatives and department heads to oversee information security initiatives and decision-making.
  2. Develop Information Security Policies and Procedures: Create comprehensive policies and procedures covering areas such as access control, risk management, incident response, and asset management. Ensure alignment with organizational objectives and regulatory requirements.Example: Develop an Incident Response Plan outlining the steps to be followed in the event of a security incident, including incident detection, containment, eradication, and recovery.
  3. Implement Security Controls: Deploy technical and administrative controls to mitigate security risks and protect information assets. These controls may include firewalls, intrusion detection systems, encryption mechanisms, and user access controls.Example: Implement role-based access control (RBAC) to restrict access to sensitive information based on users’ roles and responsibilities within the organization.
  4. Provide Training and Awareness Programs: Educate employees about their roles in maintaining information security and raise awareness about common security threats and best practices. Conduct regular training sessions and awareness campaigns to reinforce security protocols.Example: Offer cybersecurity awareness training to employees covering topics such as phishing awareness, password hygiene, and social engineering tactics.
  5. Establish Security Incident Management Procedures: Develop procedures for reporting, investigating, and responding to security incidents promptly. Define escalation paths and communication channels to ensure swift resolution of incidents.Example: Establish a Security Incident Response Team (SIRT) tasked with coordinating incident response efforts, conducting forensic investigations, and implementing remediation measures.

Auditing Compliance with Annex A.6

Audits play a crucial role in evaluating an organization’s compliance with Annex A.6 requirements. Here’s how the audit process typically unfolds:

  1. Audit Preparation: The organization gathers documentation related to information security policies, procedures, and controls. An audit team is appointed to facilitate the audit process.
  2. Audit Planning: The audit team defines the audit scope, objectives, and criteria. They develop an audit plan outlining the audit activities, timelines, and responsibilities of auditors and auditees.
  3. On-site Audit: Auditors conduct on-site visits to assess the implementation of information security controls. They review documentation, interview personnel, and observe security practices in action. Auditors may use checklists or standardized assessment tools to evaluate compliance.
  4. Audit Findings: After the on-site audit, auditors analyze their findings and identify areas of non-compliance or improvement opportunities. They document their observations, including strengths and weaknesses in the organization’s approach to information security.
  5. Reporting: Auditors prepare an audit report summarizing their findings, conclusions, and recommendations for corrective actions. The report is shared with senior management and relevant stakeholders for review and action.
  6. Follow-up: Management addresses audit findings by implementing corrective actions and improvements as recommended. Follow-up audits may be conducted to verify the effectiveness of corrective measures and ensure ongoing compliance with Annex A.6 requirements.


ISO 27001:2022 Annex A.6 underscores the importance of establishing a structured framework for organizing information security within an organization.

By following best practices for defining roles, responsibilities, processes, and controls, organizations can strengthen their security posture and mitigate risks effectively. Regular audits help assess compliance with Annex A.6 requirements and drive continuous improvement in information security governance.

The post Understanding ISO 27001:2022 Annex A.6 – Organization of Information Security first appeared on Sorin Mustaca on Cybersecurity.

Annex A of ISO 27001:2022 explained and tips to prepare for an audit

We wrote in the previous article ISO 27001:2022: chapter by chapter description about ISO 27001:2022 Annex A.

Annex A of ISO 27001:2022 is a vital component of the standard, outlining a comprehensive set of controls that organizations can implement to mitigate information security risks effectively.

These controls cover a wide range of areas, including physical security, human resources, access control, and cryptography.


In this article, we go in each category of the Annex A controls, explore practical implementation strategies, and discuss auditing methodologies to ensure compliance and effectiveness.

This article just describes the categories and the strategies for implementation, the next articles will address each category and its controls in details.

Understanding Annex A Controls

Annex A of ISO 27001:2022 contains 14 control categories, each addressing specific aspects of information security management.

  1. Information Security Policies
  2. Organization of Information Security
  3. Human Resource Security
  4. Asset Management
  5. Access Control
  6. Cryptography
  7. Physical and Environmental Security
  8. Operations Security
  9. Communications Security
  10. System Acquisition, Development, and Maintenance
  11. Supplier Relationships
  12. Information Security Incident Management
  13. Information Security Continuity
  14. Compliance

Each of these categories encompasses a set of controls designed to address specific aspects of information security management within an organization. These categories encompass policies, procedures, and technical and organizational measures designed to safeguard critical assets, prevent unauthorized access, and mitigate security threats.


The primary purpose of Annex A controls is to guide organizations in selecting appropriate security measures based on their specific context and identified risks. They are not mandatory requirements but serve as best practices for information security management.

Compared to the 2013 version, ISO 27001:2022 streamlines Annex A. The number of controls is reduced from 114 to 93, with 11 new additions reflecting evolving security threats.

The 2022 revision of ISO 27001 restructured Annex A controls into four main categories:

Main Categories of ISO 27001:2022 Controls

1. Organizational Security

This category focuses on establishing the organizational framework and governance structure necessary to manage information security effectively. It encompasses policies, procedures, and responsibilities for safeguarding information assets and ensuring compliance with regulatory requirements.


  • Information Security Policies (A.5)
  • Organization of Information Security (A.6)
  • Human Resource Security (A.7)
  • Asset Management (A.8)

2. Technical Security

This category addresses the technical aspects of information security, including access control, cryptography, and secure system development and maintenance. It involves implementing controls and measures to protect information assets from unauthorized access, alteration, or disclosure.


  • Access Control (A.9)
  • Cryptography (A.10)
  • Physical and Environmental Security (A.11)
  • Operations Security (A.12)
  • Communications Security (A.13)
  • System Acquisition, Development, and Maintenance (A.14)

3. External Relationships

This category focuses on managing security risks associated with external relationships, such as third-party suppliers and service providers. It involves assessing and monitoring the security posture of external parties and establishing contractual agreements to ensure compliance and data protection.


  • Supplier Relationships (A.15)


4. Incident Management and Continuity Planning

This category addresses preparedness and response to security incidents, as well as ensuring business continuity in the event of disruptions. It involves developing incident response plans, conducting drills, and implementing measures to minimize the impact of incidents on business operations.


  • Information Security Incident Management (A.16)
  • Information Security Continuity (A.17)
  • Compliance (A.18)

By categorizing the controls into these main categories, organizations can better understand the holistic approach required to manage information security effectively. Each category addresses specific aspects of security management, ensuring comprehensive coverage and alignment with ISO 27001:2022 requirements.


Implementation in Practice

Implementing Annex A controls requires a systematic approach tailored to the organization’s unique needs and risk profile.

Organizations should start by conducting a gap analysis and a comprehensive risk assessment to identify vulnerabilities and prioritize control implementation.

Based on the assessment findings, organizations can develop action plans to address gaps and deploy appropriate controls across different layers of their information systems.

For example,

  • implementing access control measures may involve defining user roles and privileges, implementing authentication mechanisms, and enforcing least privilege principles.
  • deploying encryption controls may require selecting suitable encryption algorithms, managing encryption keys, and implementing secure transmission protocols.

While Annex A offers a rich library of controls, remember, it’s not a one-size-fits-all approach. Organizations should conduct a risk assessment to identify their specific vulnerabilities and choose the most relevant controls.


  • Risk-Based Approach: Always prioritize controls that address the most significant information security risks identified in your organization.
  • Documentation: Document the implemented controls and how they address identified risks. This is crucial for audit purposes.
  • Continuous Improvement: Regularly review the effectiveness of your controls and update them as needed to adapt to evolving threats and organizational changes.


Summary of the 14 control categories of ISO 27001:2022


1. Information Security Policies (A.5)


Develop comprehensive policies outlining security objectives, roles, and responsibilities.


Review policy documents for completeness, relevance, and alignment with organizational goals. Assess the effectiveness of policy communication and awareness initiatives.

2. Organization of Information Security (A.6)


Designate an Information Security Officer (ISO) and establish clear reporting lines. Develop procedures for risk management and incident response.



Evaluate the clarity of roles and responsibilities within the security hierarchy. Review documentation for consistency and effectiveness.

3. Human Resource Security (A.7)


Conduct background checks during recruitment, provide security training, and define procedures for employee departures.



Verify the existence of background checks and training records. Review access controls and permissions to ensure alignment with job roles.

4. Asset Management (A.8)


Conduct an inventory of assets, classify based on criticality, and implement procedures for handling, storing, and disposing of assets.



Verify the accuracy of the asset inventory, assess the effectiveness of controls for managing assets, and review compliance with data protection regulations.

5. Access Control (A.9)


Define access control policies, implement authentication mechanisms, and enforce least privilege principles.



Review access control lists, test authentication mechanisms, and analyze access logs for unauthorized activities.

6. Cryptography (A.10)


Identify cryptographic requirements, implement encryption algorithms, and manage encryption keys securely.



Review cryptographic policies, assess the strength of encryption algorithms, and verify the integrity of key management practices.

7. Physical and Environmental Security (A.11)


Implement physical access controls, surveillance systems, and environmental controls.


Conduct site visits to assess physical security measures, review access logs, and verify compliance with environmental control standards.

8. Operations Security (A.12)

Develop procedures for system backups, change management, and incident response.


Review operational procedures, assess the effectiveness of malware protection, and analyze incident response plans.

9. Communications Security (A.13)

Secure communication channels, implement encryption protocols, and establish procedures for remote access.


Review network configurations, assess the strength of encryption protocols, and analyze network logs for suspicious activities.

10. System Acquisition, Development, and Maintenance (A.14)

Define secure coding practices, conduct security assessments, and implement change management procedures.


Review software development policies, assess code review and testing processes, and analyze change management records.

11. Supplier Relationships (A.15)

Assess supplier security posture, establish contractual agreements, and monitor supplier performance.


Review supplier contracts, assess supplier assessment processes, and verify compliance with contractual security requirements.

12. Information Security Incident Management (A.16)

Develop an incident response plan, define roles and responsibilities, and conduct regular drills.


Review the incident response plan, assess incident detection and response procedures, and analyze incident reports.

13. Information Security Continuity (A.17)

Develop a business continuity plan, implement backup and recovery procedures, and conduct regular tests.


Review the business continuity plan, assess backup and recovery procedures, and analyze test results.

14. Compliance (A.18)

Identify applicable regulations, develop policies and procedures, and conduct regular audits.


Review compliance documentation, assess compliance monitoring processes, and verify compliance with regulatory requirements.

Next article:

We analyze each of the categories of the Annex A ISO 27001:2022.

The post Annex A of ISO 27001:2022 explained and tips to prepare for an audit first appeared on Sorin Mustaca on Cybersecurity.

ISO 27001:2022: chapter by chapter description

I’ve been asked many times by customers, especially those in automotive industry, who deal with the TISAX certification, which is based on ISO 27001,  if I can make them a summary of the ISO 27001 standard.

It turns out that there has been a while since I read it, I think it was somewhere in 2016. That was the ISO 27001:2013 and in the meanwhile, the version 2022 was released.

So, let’s start with the delta between 2013 and 2022 and then we will focus on each chapter. For each chapter, we summary explain the goal, the actions required to implement the requirement and the implementation of the controls.


What’s New in ISO 27001:2022

The October 2022 revision of ISO 27001 incorporates several updates and enhancements compared to the previous 2013 version. The changes were mostly cosmetic and include restructuring and refining existing requirements.

The biggest change is Annex A which specific controls derived from ISO 27002:2022.

One significant change is the increased emphasis on the context of the organization, requiring organizations to conduct more comprehensive assessments of internal and external factors that impact information security.

The Annex A controls have been restructured and consolidated to reflect current security challenges and to reflect more modern risks and their associated controls.

Additionally, there is a greater focus on leadership involvement and accountability, with explicit requirements for top management to demonstrate active participation in setting information security objectives and promoting a culture of security awareness.

The revised standard also introduces updated terminology and references to align with current industry practices and emerging technologies, reflecting the evolving landscape of information security threats and challenges.


Chapter 1-3: Scope, Normative References and  Terms and Definitions

These chapters set the stage: they establish a common understanding of key terms used in the standard and identify relevant standards and guidelines that complement ISO 27001 requirements.


Chapter 4: Context of the Organization


Understand the internal and external factors that influence the organization’s information security objectives and risk management approach.


  1. Identify internal stakeholders, including management, employees, and third-party vendors.
  2. Assess external factors such as regulatory requirements, market trends, and competitive landscape.
  3. Determine the organization’s risk tolerance and strategic objectives.


Conduct a SWOT (Strengths, Weaknesses, Opportunities, Threats) analysis to identify internal strengths and weaknesses, as well as external opportunities and threats. Use this analysis to inform decision-making and prioritize information security initiatives.

Chapter 5: Leadership


Demonstrate commitment from top management to establish and maintain an effective ISMS.


  1. Assign responsibility for information security to senior management.
  2. Establish a governance structure to oversee the ISMS implementation.
  3. Allocate resources and provide support for information security initiatives.


Engage senior management through regular communication and reporting on information security performance and compliance. Obtain leadership buy-in for resource allocation and organizational changes necessary to support the ISMS.

Chapter 6: Planning


Develop a strategic approach to identify, assess, and mitigate information security risks.


  1. Conduct a risk assessment to identify threats, vulnerabilities, and impacts on information assets.
  2. Develop risk treatment plans to address identified risks, including mitigation, transfer, or acceptance.
  3. Define information security objectives and performance metrics to measure the effectiveness of the ISMS.


Establish a cross-functional risk management team to conduct risk assessments and develop risk treatment plans. Define clear objectives and key performance indicators (KPIs) to track progress and ensure alignment with business goals.

Chapter 7: Support


Provide the necessary resources, competencies, and awareness to support the implementation and operation of the ISMS.


  1. Allocate financial, human, and technical resources to support information security initiatives.
  2. Provide training and awareness programs to enhance employee competencies and promote a culture of security.
  3. Establish communication channels for reporting security incidents and seeking guidance on information security matters.


Develop a comprehensive training and awareness program tailored to different roles and responsibilities within the organization. Implement mechanisms for reporting security incidents and provide timely support and guidance to address emerging threats.

Chapter 8: Operation


Implement and maintain controls to manage information security risks effectively.


  1. Implement security controls based on the results of the risk assessment and risk treatment plans.
  2. Monitor and review security controls regularly to ensure effectiveness and compliance with policies and procedures.
  3. Establish incident response and business continuity plans to mitigate the impact of security incidents and disruptions.


Automate routine security tasks where possible to streamline operations and improve efficiency. Conduct regular audits and assessments to verify compliance with security policies and procedures. Continuously improve security controls based on lessons learned from security incidents and emerging threats.

Chapter 9: Performance Evaluation

Goal: Monitor, measure, analyze, and evaluate the performance of the ISMS to ensure its effectiveness and continual improvement.


  1. Define key performance indicators (KPIs) to measure the effectiveness of information security controls.
  2. Conduct internal audits and management reviews to assess compliance with ISO 27001 requirements and identify areas for improvement.
  3. Implement corrective and preventive actions to address non-conformities and enhance the performance of the ISMS.

Implementation: Establish a performance monitoring and reporting framework to track progress against established KPIs. Use data-driven insights to identify trends, patterns, and areas for improvement. Engage stakeholders in regular reviews and discussions to foster a culture of continual improvement.

Chapter 10: Improvement

Goal: Take corrective and preventive actions to address non-conformities, enhance the effectiveness of the ISMS, and achieve continual improvement.


  1. Implement corrective actions to address non-conformities identified during audits, assessments, or incident investigations.
  2. Identify opportunities for preventive actions to mitigate potential risks and prevent recurrence of security incidents.
  3. Document lessons learned and best practices to inform future decision-making and enhance the maturity of the ISMS.

Implementation: Establish a formal process for documenting and tracking corrective and preventive actions. Encourage proactive identification and resolution of issues to prevent their escalation. Foster a culture of innovation and collaboration to drive continual improvement across the organization.


What’s next?

We will focus in one of the next articles on Annex A of ISO 27001:2022.

The information security controls listed in Table A.1 are directly derived from and aligned with those listed in ISO/IEC 27002:2022, Clauses 5 to 8, and shall be used in context with 6.1.3. Information security risk treatment.


The post ISO 27001:2022: chapter by chapter description first appeared on Sorin Mustaca on Cybersecurity.

Balancing functionality and privacy concerns in AI-based Endpoint Security solutions

The integration of Artificial Intelligence (AI) in endpoint security has revolutionized the way organizations protect their devices and data.

Ok, let’s take a break here: have you read the article about Artificial Intelligence vs. Machine Learning ?


By leveraging AI and machine learning models that analyze user behavior on devices, organizations can detect anomalies and potential security threats more effectively.

However, this advanced approach to endpoint security raises significant privacy concerns, as it necessitates the collection of user activity data, sometimes in real time.

One thing needs to be clear: if you want to do anomaly detection, you need to train your ML model with what “normal” is first – this is called “baseline”. And this means that data needs to be collected from the user.

Now the question remains, how can we reduce the privacy concerns?

This short article explores the privacy challenges I think are associated with using AI models that require user data(behavior), discusses potential solutions, and suggests ways to deploy AI on devices while minimizing privacy concerns.

What are the privacy concerns when data is collected for training an ML model?

Data Collection and Usage

Collecting user data for AI-driven endpoint security involves monitoring and logging user activities on devices.

This process includes:

  • capturing information about the applications used (URLs accessed, CPU usage, memory usage),
  • websites visited and items clicked
  • files accessed
  • applications installed
  • applications started
  • time of login, logout, inactivity
  • webcam usage
  • microphone usage
  • biometrics

This data is essential for creating baselines of normal behavior and identifying deviations that might indicate security threats.

This extensive data collection raises concerns about user privacy, as it creates a comprehensive profile of a user’s digital activities.

AI-based endpoint security solutions can infer or predict sensitive information from non-sensitive forms of data, such as user preferences, interests, or behaviors.

This can enable the systems to provide personalized or customized services or recommendations, but it can also violate the privacy or autonomy of the users or the owners of the devices or networks.

For example, someone’s keyboard typing patterns can be analyzed to deduce their emotional state, which includes emotions such as nervousness, confidence, sadness or anxiety


Data Security

Safeguarding the collected user data is critical, as it contains sensitive information about an individual’s online behavior.

The risk of data breaches or unauthorized access to this information poses a significant privacy threat.

Where is this data stored, how long, how is it stored, who has access to it, how is it going to be used/processed and by who, are just a few questions that need to be asked.

GDPR has made clear which are the responsibilities of the controller and processor(s) of the data.


Transparency and Consent

A good user experience of a security product means that users will be as unaware as possible that their activity data is being collected for security purposes.

Ensuring transparency and obtaining explicit user consent for data collection is critical. Without clear communication, users may feel their privacy is being violated.


Data Retention

Storing user data indefinitely can compound privacy concerns. Organizations should establish clear data retention policies, specifying how long the data will be retained and under what circumstances it will be deleted.


User Profiling and Discrimination

The detailed user activity data collected for AI analysis can lead to user profiling, which may be used for purposes beyond cybersecurity, such as targeted advertising.

AI-based endpoint security solutions can make automated decisions or recommendations based on the data they analyze, such as blocking access, flagging anomalies, or prioritizing alerts.

Discriminatory decisions and practices can arise from the insights drawn from user behavior data. However, these decisions or recommendations can be discriminatory, unfair, inaccurate, or biased, if the data or the algorithms are flawed, incomplete, or skewed.

For example, people can be misclassified, misidentified, or judged negatively, and such errors or biases may disproportionately affect certain demographics.


Solutions to address privacy concerns

The solutions to address these concerns are actually not new, they are covered pretty good by the GDPR and other privacy laws world-wide.

They are :

Data Minimization

Organizations should adopt a data minimization approach, collecting only the data necessary for security purposes.  This is definitely not as easy as it sounds.

In Security, you usually collect as much as possible, because the more you know about your target, the better it is for the ML model (better detection, less false positives).

However, the Compliance dept. should be involved from the early stages of developing the product in order to control what is being collected.



Anonymizing user data can be a privacy-enhancing technique. By removing personally identifiable information from collected data, the risk of individual users being identified is reduced.

This works good when data is collected from many computers, but when the solution works on a single computer, it usually needs time to “learn” the user’s behavior.

There is nothing anonymous there and this is usually OK, as long as this data is not sent to the backend for further processing and analysis.



Encrypting the data collected for AI analysis ensures that even if a breach occurs, the information remains unreadable and inaccessible to unauthorized parties.

When “cleaned up” data needs to be sent, it is mandatory to send it encrypted and keep it at rest encrypted all the time.


Informed consent

Transparently informing users about data collection and obtaining their explicit consent is a fundamental step in addressing privacy concerns.

Users should have the option to opt in or out of data collection at any time. It is mandatory for the ML models to be able to cope without any datasets, because they could disappear at any time.


Data deletion

After the data is no longer needed for security analysis, organizations can ideally erase the data, and if this is not possible, then it should remove any direct or indirect associations with individual users.

Balancing Security and Privacy

Balancing AI-based endpoint security and privacy is essential. Organizations can adopt the following strategies to minimize privacy concerns:

  • Implement Strong Privacy Policies

Establish comprehensive privacy policies that clearly define data collection, usage, retention, and disposal procedures. These policies should adhere to legal and regulatory requirements for the region where the users reside (GDPR, CPA, etc.).

This can by itself be a challenging task, because no company is willing to block access to potential customers.


  • Regular risk assessment and impact analysis

Conduct periodic risk assessment and impact analysis to ensure that data collection and analysis practices align with privacy policies and legal requirements and correct any deviations promptly.

The audits should be first performed internally, in order to have time to fix any deviations. If an external audit body finds any irregularity, the company can be fined with large sums of money.


  • Third-Party Vetting

When using third-party AI solutions, organizations should thoroughly vet the security and privacy practices of these providers.


  • Ongoing Monitoring

Continuously monitor the effectiveness of privacy protection measures and adjust them as needed to address emerging privacy concerns.



AI-based endpoint security is a powerful tool for protecting devices and data from cyber threats. However, it should not come at the cost of user privacy or well-being.

Organizations must strike a delicate balance by implementing privacy-enhancing measures, obtaining informed consent, and adhering to transparent data collection and usage practices.



PS: The image of the post was generated using DALL-E.


The post Balancing functionality and privacy concerns in AI-based Endpoint Security solutions first appeared on Sorin Mustaca on Cybersecurity.

NIS2: 3.Establish a cybersecurity framework

We wrote here that the 3rd  step in implementing the requirements of the directive is to establish a cybersecurity framework.

If you haven’t read what a cybersecurity framework means, then you should read article: .


Establishing a cybersecurity framework is critically important for organizations of all sizes and types because it is the basis on which you build your cybersecurity. The cybersecurity framework is the basis of the ISMS, which represents the plan of your cybersecurity strategy.


Why it is essential to have a cybersecurity framework

In case you still wonder if you need a cybersecurity framework, here are several key reasons why it is essential:

  1. Protection against Cyber Threats
    Cyber threats are constantly evolving and becoming more sophisticated. A cybersecurity framework provides a structured approach to identifying and mitigating these threats, reducing the risk of data breaches, cyberattacks, and other security incidents.
  2. Risk Management
    Cybersecurity frameworks help organizations assess their cybersecurity risks and prioritize their efforts to address the most critical vulnerabilities. This risk-based approach ensures that resources are allocated where they are needed most.
  3. Compliance and Legal Requirements
    Many industries and regions have specific cybersecurity regulations and legal requirements that organizations must adhere to. A cybersecurity framework provides a roadmap for meeting these compliance obligations, reducing the risk of fines and legal repercussions.
  4. Business Continuity
    Cybersecurity incidents can disrupt business operations, leading to downtime, financial losses, and damage to reputation. A well-structured cybersecurity framework helps organizations prepare for and respond to incidents, minimizing their impact and ensuring business continuity.
  5. Protection of Sensitive Data
    Organizations store vast amounts of sensitive and confidential data, including customer information, financial records, and intellectual property. A cybersecurity framework helps safeguard this data from unauthorized access or theft.
  6. Preservation of Reputation
    A security breach can seriously damage an organization’s reputation and erode customer trust. Implementing a cybersecurity framework demonstrates a commitment to security, which can enhance the organization’s reputation and instill confidence among customers, partners, and stakeholders.
  7. Cost Savings
    Proactively addressing cybersecurity through a framework can ultimately save an organization money. Preventing security incidents is more cost-effective than dealing with the aftermath of a breach, which can involve significant financial and legal expenses.
  8. Consistency and Standardization
    Cybersecurity frameworks promote consistency and standardization of security practices across an organization. This is especially important in larger enterprises with multiple locations, business units, or teams, ensuring that security measures are applied uniformly.
  9. Continuous Improvement
    Cyber threats and technology evolve rapidly. A cybersecurity framework emphasizes the importance of ongoing monitoring, assessment, and improvement, helping organizations stay ahead of emerging threats and vulnerabilities.
  10. Competitive Advantage
    Having a robust cybersecurity framework can be a competitive advantage. It can differentiate an organization in the eyes of customers, partners, and investors who prioritize security when choosing business partners.

Steps to Choose or Create a Cybersecurity Framework

Choosing a cybersecurity framework is a tedious process and potentially long. If you want to succeed, then you need to plan for it. In order to create a project plan, follow these milestones:

  1. Assess Organizational Needs and Objectives
    Begin by understanding your organization’s specific cybersecurity needs, objectives, and goals. Consider the industry you operate in, the types of data you handle, and your organization’s size and complexity.
  2. Identify Relevant Regulations and Standards
    Determine which cybersecurity regulations, standards, and compliance requirements are applicable to your organization. These may include GDPR, HIPAA, ISO 27001, NIST, CIS Controls, TISAX, ISO 21434 and industry-specific regulations.
  3. Conduct a Risk Assessment
    Perform a comprehensive risk assessment to identify potential cybersecurity threats, vulnerabilities, and the potential impact of security incidents. This assessment will help you prioritize security measures.
  4. Define Your Scope
    Clearly define the scope of your cybersecurity efforts. Consider which systems, data, and assets are in scope for protection and compliance efforts. Document this scope in detail.
  5. Research Existing Frameworks
    Investigate existing cybersecurity frameworks and standards that align with your organization’s needs and objectives. Consider well-established frameworks like NIST Cybersecurity Framework, ISO 27001, CIS Controls, and others.
    Have a look here to view a comparison. Consider country-specific frameworks like the recommendations or requirements from your country’s information security agency.
  6. Evaluate Framework Alignment
    Evaluate how closely each candidate framework aligns with your organization’s requirements, risk assessment findings, and compliance obligations. Consider factors like ease of implementation and ongoing maintenance.
  7. Customization vs. Adoption
    Decide whether to adopt an existing framework as-is or customize it to fit your organization’s specific needs. Customization may be necessary to address unique risks or industry-specific requirements.
  8. Engage Stakeholders
    Involve key stakeholders, including senior leadership, IT teams, compliance experts, and legal advisors, in the decision-making process. Ensure their input and buy-in throughout the framework selection or development process.
  9. Develop Framework Documentation
    If you choose to customize or create a framework, develop comprehensive documentation that outlines the framework’s policies, procedures, controls, and guidelines. This documentation serves as a roadmap for the implementation of the ISMS.
  10. Implement and Test
    Begin implementing the selected or customized framework within your organization. Test its effectiveness in addressing cybersecurity risks and compliance requirements.
  11. Training and Awareness
    Train employees and raise awareness about the cybersecurity framework, its policies, and best practices. Ensure that everyone in the organization understands their role in maintaining security.
  12. Continuous Monitoring and Improvement
    Establish ongoing monitoring and assessment processes to ensure the framework’s effectiveness. Regularly review and update the framework to adapt to evolving threats and technology.


Key Considerations When Choosing or Creating a Cybersecurity Framework

There are some things to keep in mind when implementing the project plan for choosing the cybersecurity framework. The project can easily go out of scope because of the security landscape continuously changing.

Please review regularly these considerations and make sure you go through the list before taking any big decisions.

  1. Alignment with Objectives: Ensure that the chosen framework aligns with your organization’s cybersecurity objectives, risk profile, and compliance requirements.
  2. Applicability: Consider the framework’s applicability to your industry and specific business needs.
  3. Resource Requirements: Assess the resources (financial, human, and technological) required for framework implementation and maintenance.
  4. Scalability: Determine whether the framework can scale with your organization’s growth and evolving cybersecurity needs.
  5. Integration: Ensure that the framework can integrate with existing security technologies and processes within your organization.
  6. Cost vs. Benefit: Evaluate the cost-effectiveness of implementing and maintaining the framework relative to the expected security benefits and risk reduction.
  7. Accessibility of Expertise: Consider the availability of expertise and training resources related to the chosen framework.
  8. Audit and Certification: If compliance or certification is a goal, verify that the framework is recognized and accepted by relevant certification bodies or authorities.
  9. Legal and Privacy Considerations: Ensure that the framework supports compliance with relevant data protection and privacy laws.
  10. Flexibility: Assess the framework’s flexibility to adapt to changing threat landscapes and emerging technologies.



Having a robust cybersecurity framework can be a competitive advantage. It can differentiate an organization in the eyes of customers, partners, and investors who prioritize security when choosing business partners.

Remember that selecting or creating a cybersecurity framework is not a one-size-fits-all process. It should be a thoughtful and strategic decision that aligns with your organization’s unique needs and circumstances.

Establishing a cybersecurity framework is essential to protect an organization’s digital assets, manage risks effectively, comply with legal requirements, and maintain the trust of stakeholders.


The post NIS2: 3.Establish a cybersecurity framework first appeared on Sorin Mustaca on Cybersecurity.

NIS2: 1. Perform a gap analysis

We wrote here that the first step in implementing NIS2 requirements is to perform a gap analysis.


The most critical part when performing a gap analysis is to define upfront against which standard or security framework are you comparing the existing situation.

It is usual when performing a gap analysis of security maturity to compare against ISO 27000 standard, the ISO 27001 in particular.

Performing a gap analysis on the security stance of a company following ISO 27001 involves comparing its current security measures and practices against the requirements specified in the ISO 27001 standard.

This analysis helps identify areas where the company’s security posture aligns with the standard (compliance) and areas where there are gaps or deficiencies (non-compliance). Here’s a technical breakdown of the process:


  1. Familiarize with ISO 27001
    Understand the ISO 27001 standard and its security requirements. This includes studying the Annex A controls, which represent a comprehensive set of security best practices.
  2. Define the Scope
    Determine the scope of the analysis, starting with which areas of the organization’s security management system (SMS) will be assessed, such as specific departments, processes, assets, or locations.
    Then focus on which parts of the company’s operations will be assessed. This could include networks, systems, applications, physical security, personnel, and other relevant components.
    Keep in mind that usually the goal of the company is not reaching ISO 27001 compliance but to see their maturity level and see how prepared they are cybersecurity events and incidents.
    This means that the parallel to ISO 27001 controls (see below) should not be extremely strict, unless the goal really is achieving the ISO 27001 certification.
  3. Conduct Interviews and Gather Information
    Collaborate with key stakeholders, security personnel, and IT staff to collect relevant documentation.
    Relevant documentation is anything related to the company’s security practices, policies, procedures, risk assessments, and controls.
    This includes also security manuals, configuration details, system logs, incident reports, risk assessments, and other related documents.
  4. Create a Gap Analysis Checklist
    Develop a detailed checklist that maps the ISO 27001 controls to the company’s existing security controls and practices. The checklist should include relevant information for each control, such as descriptions, implementation status, supporting evidence, and any gaps or deviations. Always keep in mind what was decided in “2. Define the scope”, because this will give you the depth of the analysis.
  5. Assess Current Security Controls for Non-Compliance
    For each control in the checklist, assess whether the company has implemented the control as specified by ISO 27001. Evaluate the effectiveness of the existing controls in meeting the standard’s requirements. Identify gaps and areas where the company’s security measures do not meet the standard’s expectations. These gaps may include missing controls, insufficient implementation, inadequate documentation, or deviations from best practices.
  6. Prioritize and Rate the Gaps
    Classify the identified gaps based on their severity and potential impact on security. Assign a risk rating to each gap to help prioritize remediation efforts.
  7. Propose Remediation Measures
    For each identified gap, suggest specific remediation measures to address the deficiencies. These measures should align with ISO 27001 requirements and aim to improve the company’s security posture.
  8. Create an Action Plan
    Create a detailed action plan that outlines the steps to be taken to address each identified gap. This plan should include timelines, responsibilities, and resources required for implementation.
  9. Reassess and Update
    Periodically repeat the gap analysis process to assess the company’s security stance and ensure continuous improvement. Regularly review and update the action plan based on new threats, changes in the organization’s structure, or updates to the ISO 27001 standard.
  10. Monitor and Review Progress
    Once the action plan is underway, monitor the progress of each remediation effort and periodically review the improvements made. Track the status of the gaps and ensure that the company is moving towards full compliance with ISO 27001.




The post NIS2: 1. Perform a gap analysis first appeared on Sorin Mustaca on Cybersecurity.

How-To: NIS2 EU Directive

The NIS2 Directive is a European Union legislative text on cybersecurity that supersedes the first NIS (Network and Information Security) Directive, adopted in July 2016.

NIS vs. NIS2

While the first NIS (Network and Information Security) Directive increased the Member States’ cybersecurity capabilities, its implementation proved difficult, resulting in fragmentation at different levels across the internal market. To respond to the growing threats posed with digitalisation and the surge in cyber-attacks, the Commission has submitted a proposal to replace the NIS Directive and thereby strengthen the security requirements, address the security of supply chains, streamline reporting obligations, and introduce more stringent supervisory measures and stricter enforcement requirements, including harmonised sanctions across the EU.

NIS2 strengthens security requirements in the EU by expanding the NIS scope to more sectors and entities, taking into account

  • the security of supply chains,
  • streamlining reporting obligations,
  • introducing monitoring measures,
  • introducing more stringent enforcement requirements,
  • adding the concept of “management bodies” accountability within companies, and
  • harmonizing and tightening sanctions in all Member States.

To achieve the above mentioned goals, NIS2 requires member states to take a number of measures that forces them to work together:

  • Establish or improve information sharing between member states and a common incident response plan that coordinates with other member state plans
  • Establish a national Computer Emergency Response Team
  • Strengthen cooperation between public and private sector entities


In a nutshell, companies can stay compliant with the NIS2 Directive by

  • establishing an effective monitoring system that can detect intrusions, detect suspicious activities, and alert the authorities when necessary
  • developing comprehensive plans that detail how they will respond to an attack and what steps they will take to recover from it.


The official website of the EU for the NIS2 Directive has prepared an FAQ with many good questions and answers.

However, what the website is not saying (for good reasons) is how should companies start to prepare for implementing the directive.


How to start the compliance path

In order to successfully start implementing the requirements, the following steps should be implemented in this order. We will publish articles about pretty much each of these topics.


1.Conduct a gap analysis

Assess your company’s current cybersecurity practices, policies, and infrastructure against the requirements of the NIS2 directive.

Identify any gaps or areas that need improvement to comply with the directive.

Dedicated article:


2.Designate a responsible person or team

Appoint an individual or a team responsible for overseeing the implementation of the NIS2 directive within your company. This could be a dedicated cybersecurity team or an existing department with relevant expertise.

Dedicated article:


3.Establish a cybersecurity framework

Develop or update your company’s cybersecurity framework to align with the NIS2 directive. This framework should include policies, procedures, and technical controls to protect your network and information systems effectively.

Dedicated article:


4.Perform a risk assessment

Conduct a comprehensive risk assessment of your company’s network and information systems. Identify potential threats, vulnerabilities, and risks that may impact the availability, integrity, and confidentiality of critical systems and data. This assessment will help you prioritize security measures and allocate appropriate resources. Risk management and assessments are an ongoing process. Once one risk assessment is carried out, it is important to schedule regular updates to ensure all steps are maintained.

Dedicated article:


5.Implement security measures

Based on the risk assessment findings, implement appropriate security measures to mitigate identified risks. This may include network segmentation, access controls, intrusion detection systems, incident response procedures, encryption, employee training, and regular security updates, among others.

Dedicated article:


6.Establish incident response capabilities

Develop an incident response plan and establish procedures for detecting, responding to, and recovering from cybersecurity incidents. Ensure the assigned employees are trained on how to recognize and report security breaches promptly. Business continuity is a very complex topic, which must be planned with a lot of time in advance and it requires extra resources (both human and financial).

Dedicated article:


7.Continuously Monitor and review

Implement mechanisms to continuously monitor and assess your network and information systems for potential threats. Regularly review and update your cybersecurity measures to adapt to emerging risks and changes in the threat landscape.

Dedicated article:


8. Maintain documentation and records

Keep comprehensive documentation of your cybersecurity measures, risk assessments, incident response activities, and any other relevant information. This documentation will serve as evidence of compliance and may be required for regulatory audits or investigations. A good record might save your company legal and regulatory repercussions in case of a major incident (cyber related or not).

Dedicated article:


9.Engage with regulatory authorities

Stay informed about any reporting or notification obligations outlined in the NIS2 directive. Establish communication channels with the relevant regulatory authorities and comply with any reporting requirements or inquiries they may have. NIS2 strives to improve EU-wide communication and sharing of cyber events in order to better prepare answers and reactions. Communication has never been more important than now.

Dedicated article:


10. Define KPIs for cybersecurity and measures taken based on them

In order to measure the effectiveness of the cybersecurity, you need to define metrics that allow identifying and quantifying changes. Example of metrics are number of incidents, types of incidents,  how many trainings have been made, how many people were trained, how many pentests were made and how many issues were identified, and many more.

Dedicated article:




The post How-To: NIS2 EU Directive first appeared on Sorin Mustaca on Cybersecurity.

Implementing secure over-the-air (OTA) updates in embedded devices

This is a follow up article related to Secure Booting and Secure Flashing. It is the 5th article related to Strengthening the Security of Embedded Devices

Implementing secure over-the-air (OTA) updates in embedded devices requires careful consideration of various security aspects.

Here are some key steps to implement secure OTA updates:

1. Secure Communication Channel
– Use secure protocols such as HTTPS or MQTT over TLS/SSL to establish an encrypted communication channel between the device and the update server.
– Authenticate the server using certificates to ensure the device is communicating with a trusted source.
– Employ strong encryption algorithms to protect the confidentiality and integrity of the update data during transmission.

2. Code and Firmware Integrity
– Digitally sign the firmware updates using a private key and verify the signature using a corresponding public key on the device.
– Implement mechanisms such as checksums or hash functions to verify the integrity of the received update files.
– Use secure boot techniques to ensure that only trusted and authenticated firmware updates are installed on the device.

3. Access Control and Authorization
– Authenticate and authorize the device before allowing it to download and install updates.
– Implement access control mechanisms to ensure that only authorized devices or users can initiate or perform updates.
– Employ secure user authentication methods such as username/password, certificates, or tokens to validate the device’s identity.

4. Incremental Updates and Rollbacks
– Support incremental updates to reduce the data transfer size and minimize the update time, especially for large firmware files.
– Implement mechanisms to handle update failures or rollbacks in case of errors or compatibility issues during the update process.

5. Secure Storage
– Store the downloaded update files securely on the device to prevent unauthorized access or tampering.
– Use encryption and access control mechanisms to protect the firmware updates from extraction or modification by unauthorized entities.

6. Logging and Auditing
– Maintain logs of OTA update activities, including details such as update versions, timestamps, and device identification.
– Implement auditing mechanisms to track and monitor update processes, detecting any suspicious or unauthorized activities.

7. Regular Security Updates and Patch Management
– Continuously monitor for security vulnerabilities and release patches or updates as needed.
– Implement a robust patch management system to ensure timely deployment of security updates to the embedded devices.

8. Testing and Validation
– Conduct thorough testing and validation of the OTA update process, including functional, security, and compatibility testing.
– Perform vulnerability assessments and penetration testing to identify potential weaknesses in the OTA update implementation.

Last, but not least:

You need to have a secure backend that serves the updates. Make sure that you have configured the server correctly, secure and that it is always updated to the latest version.


Follow these best practices to establish a secure OTA update mechanism, ensuring that devices receive timely and secure firmware updates while mitigating the risk of unauthorized access, tampering, or exploitation during the update process.

The post Implementing secure over-the-air (OTA) updates in embedded devices first appeared on Sorin Mustaca on Cybersecurity.