The CER Regulation and Insider Risk: What Organisations Need to Know

In an increasingly interconnected world, the resilience of critical infrastructure is paramount. The European Union has recognised this imperative by introducing two significant directives: the Critical Entities Resilience (CER) Directive and the Network and Information Security Directive (NIS2). Aimed at enhancing both physical and digital defences, these directives place new responsibilities on organisations across multiple sectors. One area that requires particular attention is Insider Risk - a threat that can undermine even the most robust security measures. This blog post explores the implications of the new CER regulation, the importance of addressing insider risk, and how organisations can proactively prepare for compliance.

Unpacking the CER and NIS2 Directives

The CER Directive

The CER Directive focuses on strengthening the physical resilience of critical entities against a range of threats, including natural hazards, terrorist attacks, insider threats, sabotage, and public health emergencies. Key elements include:

Sector Coverage: Applies to eleven vital sectors, such as energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, and the production, processing, and distribution of food.

• Develop a national strategy for enhancing the resilience of critical entities.
• Conduct regular risk assessments to identify entities considered critical or vital for society and the economy.
• Provide support and guidance to these critical entities.

The NIS2 Directive

Building upon its predecessor, the original NIS directive, NIS2 aims to strengthen cybersecurity across essential and important services. Notable features include:

• Expanded Scope: Covers a broader range of sectors and introduces stricter security requirements.

• Organisational Obligations:

  • Implement comprehensive risk management measures to mitigate cyber risks.
  • Report significant cyber incidents promptly to relevant authorities.
  • Ensure supply chain security and address risks posed by suppliers and service providers.

Implementation in the Netherlands

National Legislation

In the Netherlands, these directives are being transposed into national law:

• CER Directive: Implemented as the Wet Weerbaarheid Kritieke Entiteiten (Wwke).

• NIS2 Directive: Transposed into the Cyberbeveiligingswet (Cbw).

Timeline and Compliance

• Transposition Deadline: Member States have until 17 October 2024 to incorporate the directives into national legislation.

• Organisational Impact:

  • Organisations must assess whether they fall under the scope of these directives.
  • The Dutch government provides resources, including a self-evaluation questionnaire, to assist in this determination.
  • Organisations are advised not to wait until the legislation comes into force but to start preparing now, as the risks exist already.

The Intersection of CER Regulation and Insider Risk

Understanding Insider Risk

Insider risk refers to threats posed by individuals within an organisation who have access to critical systems and information. These insiders can be:

• Malicious Actors: Employees or contractors who intentionally cause harm, such as theft, sabotage, or espionage.

• Negligent Individuals: Staff who inadvertently compromise security through careless actions, such as mishandling sensitive data or falling victim to phishing attacks.

Why Insider Risk Matters

• Access Privileges: Insiders often have legitimate access to systems and information, allowing them to bypass external security measures.

• Potential Impact: Insider actions can lead to significant disruptions, financial losses, legal consequences, and reputational damage.

• Regulatory Compliance: Addressing insider risk is essential for meeting the obligations set out in the CER and NIS2 directives, which emphasise comprehensive risk management.

Case Examples

• Sabotage in the Energy Sector: Instances where disgruntled employees have disrupted power grids or tampered with critical systems.

• Data Breaches in Healthcare: Staff mishandling patient information, leading to privacy violations and fines under regulations like GDPR.

Preparing for Compliance and Mitigating Insider Risk

Conducting Comprehensive Risk Assessments

• Identify Vulnerabilities: Evaluate all potential risks, including those posed by insiders, across both physical and digital domains.

• Assess Critical Functions: Determine which assets and services are essential to operations and could be targets for insider threats.

Developing Resilience Strategies

• Implement Security Protocols: Establish robust policies that address both external threats and insider risks.

• Access Controls: Restrict access to critical systems and data based on role necessity and implement the principle of least privilege.

• Monitoring and Detection: Use technology solutions to monitor for unusual activities that may indicate insider threats, such as anomalous access patterns.

Fostering a Security-Conscious Culture

• Employee Training: Regularly educate staff about security policies, threat awareness, and their role in maintaining security.

• Clear Communication: Ensure employees understand the importance of compliance and the potential consequences of violations.

• Reporting Mechanisms: Create confidential channels for reporting suspicious behaviour without fear of retaliation.

Support and Resources from the EU and National Authorities

EU-Level Assistance

• Critical Entities Resilience Group (CERG): Facilitates cooperation among Member States and provides guidance on best practices.

• Funding Opportunities: Access to grants for research and initiatives aimed at enhancing infrastructure resilience.

National Support

• Dutch Government Resources:

  • Guidance documents on compliance requirements and best practices.
  • Tools for self-assessment and risk evaluation.

• Protective Security Advisory Missions: Available to critical infrastructure entities seeking expert advice on enhancing security measures.

How Signpost Six Can Help You Get Ahead of CER

As organisations navigate the complexities of the CER and NIS2 directives, partnering with experts in insider risk management can provide a significant advantage. Signpost Six specialises in helping organisations proactively address insider risks, helping with compliance and enhancing overall resilience.

Expertise in Insider Risk Measures

• Tailored Solutions: Signpost Six offers customised insider risk programmes that align with your organisation's specific needs and the requirements of the CER directive.

• Comprehensive Training: Equip your staff with the knowledge and skills to recognise and mitigate insider threats through specialised training programmes.

• Policy Development: Assist in creating and refining policies and procedures that address insider risk, ensuring they meet regulatory standards and best practices.

Providing Insider Risk Assessments

• In-Depth Analysis: Conduct thorough assessments to identify potential insider risks within your organisation, examining both human and technical factors.

• Risk Mitigation Strategies: Develop actionable plans to address identified vulnerabilities, including recommendations for technology solutions and process improvements.

• Continuous Monitoring: Implement systems for ongoing assessment and improvement of insider risk management practices.

Benefits of Partnering with Signpost Six

• Stay Ahead of Compliance: By addressing insider risk now, you position your organisation to meet CER requirements ahead of time.

• Enhance Organisational Resilience: Strengthen your defences against both intentional and unintentional insider threats.

• Expert Guidance: Leverage the expertise of professionals dedicated to insider risk management and critical infrastructure protection.

Get Started Today

Taking proactive steps to manage insider risk is not just about compliance—it's about safeguarding your organisation's future. Contact Signpost Six to learn how we can help you navigate the complexities of the CER directive and build a more secure, resilient organisation.