African Companies Urged to Comply with EU's NIS2 Cybersecurity Directive Amid Rising Trade Ties

The directive’s stringent cybersecurity measures aim to protect critical infrastructure and ensure the integrity of global supply chains.

African companies trading with the European Union (EU) face significant changes as the EU's new NIS2 cybersecurity directive comes into effect. Check Point Software Technologies, a leading AI-powered cloud cybersecurity provider, is urging these businesses to understand and comply with this stringent regulation to safeguard their operations and maintain vital trade relationships.

The NIS2 Directive mandates that EU member states amend their national legislation to implement strict cybersecurity requirements, including enhanced management accountability, timely reporting to authorities, risk management, and robust business continuity planning. With this directive, African companies engaged in trade with the EU will be under increased scrutiny.

Broader Scope and Increased Accountability

Expanding on the original NIS1 directive from 2016, the NIS2 directive now covers a wide array of sectors—Energy, Banking, Transport, Digital Infrastructure, Healthcare, Food Production, and Research. Over 80% of European enterprises fall under its jurisdiction, which now also extends to global supply chain partners, many of which are based in Africa.

Collins Emadau, Check Point Partner and Director at Westcon, emphasizes, "Africa's economic future hinges on its relationship with Europe. Businesses, particularly in South Africa, Kenya, and Nigeria, must grasp the significant implications of NIS2. Non-compliance could lead to substantial fines and jeopardize critical trade relationships with EU member states."

Impact on Trade and Economy

The EU is Africa’s largest trading partner, with trade agreements worth billions annually. African businesses, particularly in sectors crucial to the EU’s supply chains, must comply with NIS2 to sustain their trade partnerships. The directive’s stringent cybersecurity measures aim to protect critical infrastructure and ensure the integrity of global supply chains.

Issam El Haddioui, Head of Security Sales Engineering for Africa at Check Point, states, "NIS2 sets a new benchmark for cybersecurity. African businesses need to take action immediately. Awareness of these requirements is critical—not just for maintaining EU partnerships but for bolstering the overall resilience of African economies against cyber threats."

Current Cybersecurity Landscape in Africa

According to Interpol’s 2021 Africa Cyberthreat Assessment Report, African organizations currently invest an average of only 0.05% of their revenue on cybersecurity, significantly lower than the global average of 0.3-0.5%. The financial impact of cybercrime in Africa is estimated at over $4 billion USD, equivalent to about 10% of the continent’s GDP. By improving their cybersecurity posture, African businesses can not only align with international standards but also protect their data and reputations.

Increased Personal Liability for Executives

NIS2 introduces personal liability for business executives in the event of a cyber incident, allowing for financial accountability in cases of breaches. Fines can reach up to EUR 7 million or 1.4% of a company’s global annual turnover—whichever is higher. This requirement underscores the critical role of corporate leadership in ensuring robust cybersecurity practices.

Four Key Steps for Compliance

To navigate the complexities of NIS2 compliance, Check Point recommends that African businesses take the following actions:

Knowledge: Business leaders should gain a fundamental understanding of cybersecurity to effectively communicate with IT teams and facilitate informed decision-making.

People: Establish a nimble IT security department, appointing key roles like a Data Protection Officer (DPO) and a Chief Information Security Officer (CISO) to distribute responsibilities effectively.

Audit: Conduct regular risk assessments and audits to identify and mitigate vulnerabilities, ensuring continuous monitoring to stay compliant with evolving threats.

Incident Management: Develop clear protocols for responding to cyber incidents, including rapid reporting to national authorities and stakeholders.A Long-Term Commitment to Cybersecurity

Compliance with NIS2 is not merely a checkbox exercise; it necessitates a sustained commitment to cybersecurity. Starting in 2028, organizations will be required to annually document their NIS2-compliant IT infrastructure, demonstrating alignment with the latest technological advancements.

El Haddioui further asserts, "Economic leaders in Africa, such as South Africa, Kenya, and Nigeria, should consider adopting the NIS2 framework to strengthen their national cybersecurity regulations. By enhancing cyber-readiness, African businesses can meet international standards and protect their data and operations against evolving threats."

In conclusion, the NIS2 directive signifies a critical shift in the cybersecurity landscape. African business leaders must recognize that cybersecurity is now a matter of survival rather than mere compliance. Proactive measures can safeguard their futures, avoid hefty penalties, and ensure their organizations thrive in an increasingly interconnected global economy.