Most of the discussion around NIS2 so far has focused on fines and management liability. In this issue of the Fort Cyber Brief newsletter, we look at two sectors where the stakes are operational before they are legal.
In brief
- In healthcare, the most exposed point is external suppliers’ access to critical systems.
- In energy, the main challenge is mixed IT and OT/SCADA infrastructure, with equipment that is decades old.
- In both sectors, supply chain requirements give companies new contractual leverage over suppliers.
Healthcare
The risk most often comes through suppliers
Hospitals, clinics, laboratories, and pharmacies depend on an extensive network of partners: medical equipment manufacturers, laboratory and imaging software providers, cloud services, and maintenance providers. Many of them have direct access to systems that process medical data.
Under Article 21, the most relevant categories for this sector are business continuity (category 3), supply chain security (4), cryptography (8), and access control (9). Supplier assessments and the inclusion of security requirements in contracts are mandatory, but they are not yet widespread practices among hospitals in Romania.
Hypothetical scenario
The provider maintaining a hospital’s imaging system has remote access. An employee’s credentials at the provider are compromised through a phishing attack, allowing attackers to gain access to the hospital’s network. Because external access was not monitored, the attack spreads: image archiving servers are encrypted, examinations are delayed, and the hospital cannot immediately determine which data has been accessed.
The measures that would have limited the incident are well-known and readily available: named and temporary access for suppliers, multi-factor authentication, network segmentation, activity monitoring, and contractual clauses regarding incident notification.
For the pharmaceutical industry, the chain extends to CMOs, distributors, warehouses, and temperature-controlled transport. The assessment of each supplier should answer a simple question: can a vulnerability from this partner halt production or affect the traceability of a batch?
Energy and Utilities
Modern infrastructure built on top of old equipment
Operators in electricity, oil, gas, hydrogen, and district heating are essential entities under NIS2. A disruption of their systems can affect thousands or even millions of consumers.
The sector’s specific difficulty is the coexistence of modern IT systems with OT/SCADA equipment installed decades ago, designed before cyber threats were a concern. This gives rise to the priorities:
- Inventory of IT and OT assets and access control (category 9), as a starting point for any other measure.
- Security in procurement and maintenance (category 5), for equipment that remains in operation long-term.
- Supplier management (category 4), given the large number of providers involved in operations.
- Business continuity (category 3), which all the others support.
An advantage that many energy companies have: technical processes are already documented, which significantly shortens the inventory stage.
Business impact
What a compliant company gains
Compliance has a cost, but it also produces results that companies can use directly in commercial relationships and in reducing costs
Leverage in supplier relationships
An annual pentest report required by contract replaces general statements about security with verifiable proof. Based on it, suppliers can be compared, asked for remediations, and terms can be renegotiated.
Redistribution of operational risk
NIS2 provides the legal basis for clauses through which suppliers attest to the security measures applied. Legal liability remains with the entity that reports the incident, but the company’s contractual position improves considerably if the incident is caused by the supplier.
Reduced costs through asset inventorying
The exercise required by law reveals unused licenses, redundant servers and cloud instances, and applications installed without the IT department’s knowledge. In many cases, the savings cover the cost of the inventory.
Credibility in procurement processes
More and more requests for proposals include a cybersecurity section. The lack of a solid response can eliminate a supplier before the discussion about price even begins.
The FORT perspective
We expect NIS2 to follow the same path as e-Factura: a narrow scope at first, gradually expanded. The effect is already visible in the supply chain. Companies that supply hospitals or energy operators may receive requirements for security assessments, incident response evidence, and compliance proof, even if they are not directly targeted by the law.
This article is an excerpt from the whitepaper “What No One Tells You About NIS2,” which examines ten industries, each in a chapter that can be read independently, with risk scenarios and action recommendations.
You’ll be able to download the whitepaper soon.
And for a discussion about your organization’s situation, schedule a meeting with the FORT team.
