text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text:  Energy (electricity, oil and gas)  Online marketplace  Transport (air, rail, water and road)  Online search engine  Banking  Cloud computing service  Financial market infrastructures  Health  Drinking water supply and distribution  Digital infrastructure

text: December 2020

text: December 2020

text: December 2020

text: As previously stated, the definition of the industries is not directly related to the definition of the sectors in the NIS Directive used in chapter 3 of this report. The relevant definitions are available in Annex B.

text: December 2020

text: December 2020

text: Annex B provides detailed definitions for the security domains referenced in chapter 2.

text: December 2020

text: Software Publishing and Internet Services 39% 35% 3% 14% 3%3%3%

text: Pharmaceuticals 35% 25% 12% 5% 7% 12% 4% Insurance 28% 20% 24% 10% 6% 6% 6% CPG 25% 20% 20% 5% 5% 20% 5% Government 25% 14% 10% 27% 6% 11% 7% Resources 22% 19% 14% 13% 8% 14% 11%

text: Professional Services 22% 17% 15% 16% 12% 10% 8%

text: Banking & Financial Services 22% 19% 13% 14% 13% 11% 8%

text: Transportation 22% 14% 20% 17% 6% 5% 16% Manufacturing 19% 19% 15% 16% 9% 15% 7%

text: Cross industry EU avg 19% 19% 17% 16% 9% 12% 9%

text: Cross industry US avg 19% 18% 17% 13% 13% 12% 8%

text: Energy 18% 27% 10% 12% 15% 11% 7% Utilities 17% 11% 24% 11% 8% 18% 11% Education 16% 28% 11% 16% 11% 12% 7% Retail 11% 23% 17% 26% 6% 10% 7% Government 11% 14% 28% 18% 9% 9% 12%

text: Food and Beverage Processing 10% 5% 38% 10% 8% 23% 8%

text: Electronics 8% 9% 20% 16% 14% 17% 16% Vulnerability Governance, Network Application Identity & Endpoint Data Risks & Security Security Security management access Security Compliance management

text: Source: Gartner ITKMD 2020 data, Scope: EU countries + UK and US for reference

text: December 2020

text: December 2020

text: Cloud Access Security Brokers 33% Network Detection and Response 21% Access mgt. 19% Encryption 19% Threat Intelligence 16% Endpoint Protection Platform (Enterprise) 14% Secure E-mail Gateway 13% Privileged Access mgt. 11% Enterprise Data Loss Prevention 11% Network Access Control 11% Secure Web Gateway 10% Security Information and Event mgt. (SIEM) 10% Consulting 9% Web Application Firewalls 9% Vulnerability Assessment 8% Tokenization 8% Integrated Risk mgt. Solutions 8% Application Security Testing 7% IT Outsourcing 7% Other Information Security 6% Firewall Equipment 6% Identity Governance and Administration 6% User Authentication 5% Implementation 4% Hardware Support 4% Consumer Security 4% Source: Gartner Forecast: IT security and Risk Management, Worldwide, 2019 - 2024, 3Q20 Update

text: December 2020

text: https://www.congress.gov/bill/116th-congress/senate-bill/1010 5 https://www.natlawreview.com/article/court-approves-class-action-settlement-re-yahoo-inc-customer-data-security-breach 6 https://www.reuters.com/article/otc-equifax-frankel-idUSKCN1PN2TJ 7 https://in.reuters.com/article/dataprivacy-chegg/chegg-data-breach-lawsuit-heads-to-arbitration-idUSL2N2CG2JU 8 https://www.reuters.com/article/us-britain-marriott-dataprotection-idUSKCN25F0S2

text: December 2020

text: More than 1Bn€ 6,4% (16) 750 - 1000 M€ 5,2% (13) 500 - 750 M€ 3,2% (8) 250 - 500 M€ 10,4% (26) 100 - 250 M€ 17,5% (44) 50 - 100 M€ 13,9% (35) 10 - 50 M€ 17,9% (45) 5 - 10 M€ 5,2% (13) Less than 5M€ 10% (25) Don't know 10,4% (26) n = 251 Q: What is your organization estimated IT budget range for 2019 (including hardware, software, internal personnel, contractors and outsourcing spend)?

text: December 2020

text: B anking 0,0% 0,0% 17,5% 5,0% 22,5% 10,0% 2,5% 15,0% 15,0% 12,5% Clo ud co mputing 8,0% 16,0% 12,0% 16,0% 0,0% 12,0% 0,0% 4,0% 16,0% 16,0% Digital infra. 44,0% 8,0% 16,0% 4,0% 4,0% 8,0% 0,0% 4,0% 4,0% 8,0% Drinking water 0,0% 6,7% 46,7% 40,0% 0,0% 6,7% 0,0% 0,0% 0,0% 0,0% Energy 0,0% 0,0% 0,0% 23,3% 33,3% 16,7% 6,7% 10,0% 3,3% 6,7% Financial market infra. 0,0% 26,7% 20,0% 20,0% 13,3% 6,7% 0,0% 6,7% 0,0% 6,7% Healthcare 5,7% 0,0% 22,9% 25,7% 22,9% 11,4% 2,9% 0,0% 0,0% 8,6% Online M arketplace 12,0% 4,0% 24,0% 0,0% 4,0% 4,0% 12,0% 4,0% 16,0% 20,0% Transpo rt 11,4% 2,9% 20,0% 8,6% 34,3% 14,3% 0,0% 0,0% 0,0% 8,6% Overall 9,0% 5,3% 18,4% 14,3% 17,6% 10,6% 2,9% 5,3% 6,5% 10,2% 5M € o r less 5 - 10 M € 11 - 50 M € 50 - 100 M € 100 - 250 M € 250 - 500 M € 500 - 750 M € 750 - 1,000 M € 1 B n€ o r mo re Do esn't kno w

text: More than 100 M€ 11,6% (29) 50 - 100 M€ 13,1% (33) 25 - 50 M€ 15,1% (38) 10 - 25 M€ 17,9% (45) 5 - 10 M€ 11,6% (29) 1 - 5 M€ 10,8% (27) 500 K€ - 1 M€ 4,8% (12) 100 - 500 K€ 8,4% (21) Less than 100K€ 0,8% (2) Don't know 6% (15) n = 251 Q: What is your organization estimated information security budget range for 2019 (including hardware, software, internal personnel, contractors and outsourcing spend)?

text: December 2020

text: B anking 0,0% 2,5% 0,0% 10,0% 5,0% 15,0% 22,5% 20,0% 20,0% 5,0% Clo ud co mputing 0,0% 12,0% 12,0% 12,0% 4,0% 16,0% 0,0% 16,0% 20,0% 8,0% Digital infra. 8,0% 32,0% 16,0% 20,0% 4,0% 0,0% 4,0% 4,0% 12,0% 0,0% Drinking water 0,0% 0,0% 0,0% 33,3% 40,0% 20,0% 0,0% 6,7% 0,0% 0,0% Energy 0,0% 0,0% 0,0% 0,0% 3,3% 30,0% 33,3% 20,0% 10,0% 3,3% Financial market infra. 0,0% 0,0% 6,7% 20,0% 20,0% 33,3% 0,0% 6,7% 6,7% 6,7% Healthcare 0,0% 5,7% 0,0% 11,4% 14,3% 22,9% 20,0% 17,1% 0,0% 8,6% Online M arketplace 0,0% 8,0% 8,0% 0,0% 24,0% 0,0% 4,0% 12,0% 32,0% 12,0% Transpo rt 0,0% 11,4% 0,0% 8,6% 11,4% 28,6% 25,7% 8,6% 0,0% 5,7% Overall 0,8% 8,2% 4,1% 11,0% 11,8% 18,4% 15,1% 13,5% 11,4% 5,7% M o re than 50 - 100 M € 25-100 M € 10-25 M € 5-10 M € 2-5 M € 0.5-1 M € 100-500 K€ Less than Do esn't 100 M € 100K€ kno w

text: ranges in these figures refer to

text: investments directly related to

text: 5M € o r less 5 - 10 M € 11 - 50 M € 50 - 100 M € 100 - 250 M € 250 - 500 M € 500 - 750 M € 750 - 1,000 M € 1 B n€ o r mo re Do esn't kno w NIS products and

text: services. They do not include for

text: M o re than 100 M € 0,0% 0,0% 0,0% 0,0% 0,0% 7,7% 62,5% 30,8% 93,8% 11,5%

text: instance additional budget forecasted

text: - 100 M € 0,0% 0,0% 0,0% 2,9% 2,3% 73,1% 25,0% 46,2% 6,3% 11,5%

text: for built-in security features in non-

text: 25-100 M € 0,0% 0,0% 0,0% 0,0% 63,6% 19,2% 12,5% 15,4% 0,0% 7,7% NIS products. 10-25 M € 0,0% 0,0% 8,9% 74,3% 34,1% 0,0% 0,0% 0,0% 0,0% 0,0% 5-10 M € 0,0% 0,0% 46,7% 22,9% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 2-5 M € 0,0% 53,8% 42,2% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 3,8% 0.5-1 M € 24,0% 30,8% 2,2% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 3,8% 100-500 K€ 68,0% 15,4% 0,0% 0,0% 0,0% 0,0% 0,0% 7,7% 0,0% 3,8% Less than 100K€ 8,0% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% Do esn't kno w 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 57,7%

text: December 2020

text: France 2,0% 7,8% 5,9% 17,6% 66,7% Germany 0,0% 3,9% 5,9% 19,6% 70,6% Italy 0,0% 8,0% 8,0% 20,0% 64,0% Poland 0,0% 16,3% 10,2% 30,6% 42,9% Spain 0,0% 14,0% 10,0% 28,0% 48,0% Overall 0,4% 10,0% 8,0% 23,1% 58,6% Leveraged as Work in Not planned Planned Completed best practices progress

text: December 2020

text: Banking 0,0% 2,5% 5,0% 15,0% 77,5% (58.8%)

text: Cloud computing 0,0% 16,0% 8,0% 20,0% 56,0%

text: Digital infra. 4,0% 24,0% 24,0% 16,0% 32,0%

text: Drinking water 0,0% 26,7% 0,0% 40,0% 33,3%

text: Energy 0,0% 0,0% 0,0% 23,3% 76,7%

text: Financial market infra. 0,0% 6,7% 20,0% 6,7% 66,7%

text: Healthcare 0,0% 5,7% 5,7% 37,1% 51,4%

text: Online Marketplace 0,0% 12,0% 0,0% 20,0% 68,0%

text: Transport 0,0% 11,4% 8,6% 28,6% 51,4%

text: Overall 0,4% 10,2% 7,3% 23,3% 58,8% Leveraged as Work in Not planned Planned Completed best practices progress

text: December 2020

text: More than 20 0% (0) 18-20 8% (18) 16 - 18 25,8% (58) 14 - 16 35,1% (79) 12 - 14 18,7% (42) Less than 12 12,4% (28) n = 225 Q: What are the start date and estimated duration of the NIS program or projects? Scope: Organizations with existing or planned NIS program

text: December 2020

text: France 2,2% 50,0% 28,3% 13,0% 4,3% 2,2% Germany 4,1% 40,8% 36,7% 12,2% 6,1% 0,0% Italy 0,0% 37,0% 43,5% 13,0% 4,3% 2,2% Poland 0,0% 19,5% 43,9% 24,4% 12,2% 0,0% Spain 0,0% 30,2% 39,5% 20,9% 7,0% 2,3% Grand Total 1,3% 36,0% 38,2% 16,4% 6,7% 1,3% 2017 2018 2019 2020 2021 2022 or later

text: Banking 0,0% 51,3% 33,3% 10,3% 5,1% 0,0% Cloud computing 0,0% 28,6% 38,1% 23,8% 9,5% 0,0% Digital infra. 0,0% 22,2% 38,9% 11,1% 22,2% 5,6% Drinking water 0,0% 9,1% 54,5% 36,4% 0,0% 0,0% Energy 0,0% 63,3% 23,3% 13,3% 0,0% 0,0% Financial market infra. 0,0% 21,4% 50,0% 7,1% 21,4% 0,0% Healthcare 0,0% 33,3% 39,4% 21,2% 3,0% 3,0% Online Marketplace 4,5% 36,4% 40,9% 18,2% 0,0% 0,0% Transport 3,2% 25,8% 45,2% 19,4% 6,5% 0,0% Overall 0,9% 36,5% 38,4% 16,9% 6,4% 0,9% 2017 2018 2019 2020 2021 2022 or later

text: December 2020

text: More than 10 M€ 0% (0) 7.5 - 10 M€ 0% (0) 5 - 7.5 M€ 0% (0) 2.5 - 5 M€ 0,4% (1) 1 - 2.5 M€ 1,8% (4) 250 - 1000 K€ 22,2% (50) 100 -250 K€ 42,7% (96) 50 - 100 K€ 23,1% (52) Less than 50 K€ 8,9% (20) No dedicated budget 0,9% (2) n = 225 Q: What is the estimated budget of your organization dedicated to the NIS program or projects? Scope: Organizations with existing or planned NIS program

text: December 2020

text: France 6,5% 17,4% 60,9% 15,2% 0,0% 0,0% 0,0% Germany 6,1% 28,6% 42,9% 20,4% 2,0% 0,0% 0,0% Italy 10,9% 19,6% 30,4% 32,6% 4,3% 0,0% 2,2% Poland 14,6% 26,8% 31,7% 26,8% 0,0% 0,0% 0,0% Spain 7,0% 23,3% 46,5% 16,3% 2,3% 2,3% 2,3% Grand Total 8,9% 23,1% 42,7% 22,2% 1,8% 0,4% 0,9% <50K€ 50 - 100 K€ 100 - 250 K€ 250 K€ - 1M€ 1 - 2.5 M€ 2.5 - 5 M€ no dedicated budget

text: Banking 2,6% 20,5% 46,2% 28,2% 2,6% 0,0% 0,0% Cloud computing 9,5% 38,1% 28,6% 23,8% 0,0% 0,0% 0,0% Digital infra. 38,9% 27,8% 11,1% 16,7% 0,0% 0,0% 5,6% Drinking water 9,1% 36,4% 54,5% 0,0% 0,0% 0,0% 0,0% Energy 0,0% 6,7% 46,7% 40,0% 3,3% 3,3% 0,0% Financial market infra. 21,4% 35,7% 21,4% 14,3% 0,0% 0,0% 7,1% Healthcare 3,0% 27,3% 54,5% 12,1% 3,0% 0,0% 0,0% Online Marketplace 4,5% 22,7% 40,9% 27,3% 4,5% 0,0% 0,0% Transport 3,2% 16,1% 61,3% 19,4% 0,0% 0,0% 0,0% Overall 7,8% 23,3% 43,4% 22,4% 1,8% 0,5% 0,9% no dedicated <50K€ 50 - 100 K€ 100 - 250 K€ 250 K€ - 1M€ 1 - 2.5 M€ 2.5 - 5 M€ budget

text: December 2020

text: 100K€ 100-500 K€ 0.5-1 M€ 1-5 M€ 5-10 M€ 10-25 M€ 25-100 M€ 50 - 100 M€ 100 M€ Doesn't know or less or more 5M€ or more 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 2.5 - 5 M€ 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 0,0% 3,4% 0,0% 1 - 2.5 M€ 0,0% 0,0% 0,0% 0,0% 0,0% 2,3% 0,0% 3,0% 6,9% 0,0% 0.25 - 1 M€ 0,0% 0,0% 0,0% 0,0% 4,0% 4,5% 21,1% 45,5% 72,4% 23,1% 100 - 250 K€ 0,0% 0,0% 10,0% 20,0% 56,0% 59,1% 68,4% 45,5% 17,2% 38,5% 50 - 100 K€ 0,0% 54,5% 50,0% 45,0% 28,0% 31,8% 10,5% 6,1% 0,0% 38,5% 50 K€ or less 100,0% 45,5% 40,0% 30,0% 8,0% 2,3% 0,0% 0,0% 0,0% 0,0% No NIS budget 0,0% 0,0% 0,0% 5,0% 4,0% 0,0% 0,0% 0,0% 0,0% 0,0%

text: December 2020

text: France 45,7% 19,6% 34,8%

text: Germany 49,0% 28,6% 22,4%

text: Italy 47,8% 15,2% 37,0%

text: Poland 63,4% 12,2% 24,4%

text: Spain 48,8% 25,6% 25,6%

text: Grand Total 50,7% 20,4% 28,9% No additional Only New hires staff contractors

text: December 2020

text: B anking 46,2% 10,3% 43,6% Clo ud co mputing 71,4% 14,3% 14,3% Digital infra. 44,4% 38,9% 16,7% Drinking water 45,5% 45,5% 9,1% Energy 50,0% 10,0% 40,0% Financial market infra. 28,6% 35,7% 35,7% Healthcare 36,4% 21,2% 42,4% Online M arketplace 63,6% 27,3% 9,1% Transpo rt 64,5% 9,7% 25,8% Overall 50,7% 19,6% 29,7% No additio nal Only New hires staff co ntracto rs

text: 10+ 3,1% (2) 9 0% (0) 8 0% (0) 7 1,5% (1) 6 9,2% (6) 5 6,2% (4) 4 26,2% (17) 3 32,3% (21) 2 18,5% (12) 1 3,1% (2) n = 65 Q: Regarding last three years, did your organization hire additional security staff specifically to implement the NIS Directive? If yes, how many? Scope: Organizations with existing or planned NIS program that hired new staff to implement NIS Directive

text: December 2020

text: Governance, Risk & Compliance 64,5% (162) Network Security 48,6% (122) BCM (*) 33,1% (83) Vulnerability Management 23,9% (60) Data Security 17,9% (45) Applications Security 4% (10) Physical Security 1,6% (4) IAM (**) 1,2% (3) Endpoint Security 1,2% (3) Security Analytics 0% (0) n = 225 Q: What are the top 3 security domains where your organization invested the most to implement the NIS Directive? Scope: Organizations with existing or planned NIS program, (*) = Business Continuity Management (**) = Identity Access Management

text: France 5,9% 17,6% 25,5% 43,1% 0,0% 49,0% 0,0% 72,5% 35,3% 2,0% Germany 3,9% 9,8% 25,5% 58,8% 0,0% 51,0% 3,9% 62,7% 39,2% 2,0% Italy 4,0% 14,0% 32,0% 46,0% 2,0% 52,0% 0,0% 66,0% 30,0% 4,0% Poland 2,0% 18,4% 16,3% 44,9% 4,1% 55,1% 0,0% 59,2% 30,6% 0,0% Spain 4,0% 30,0% 20,0% 50,0% 0,0% 40,0% 2,0% 62,0% 30,0% 0,0% Overall 4,0% 17,9% 23,9% 48,6% 1,2% 49,4% 1,2% 64,5% 33,1% 1,6% Applications Vulnerability Network Endpoint Security Identity and Governance, Business Physical Security Data Security Management Security Security Analytics Access Risk and Continuity Security Management Compliance Management

text: December 2020

text: Banking 10,0% 22,5% 37,5% 47,5% 0,0% 47,5% 0,0% 65,0% 40,0% 2,5%

text: Cloud computing 0,0% 24,0% 16,0% 40,0% 4,0% 56,0% 0,0% 56,0% 28,0% 0,0%

text: Digital infra. 8,0% 28,0% 4,0% 44,0% 4,0% 40,0% 4,0% 40,0% 28,0% 0,0%

text: Drinking water 0,0% 0,0% 13,3% 40,0% 0,0% 13,3% 6,7% 66,7% 40,0% 0,0%

text: Energy 6,7% 10,0% 30,0% 53,3% 0,0% 60,0% 3,3% 80,0% 36,7% 3,3%

text: Financial market infra. 0,0% 20,0% 13,3% 66,7% 0,0% 60,0% 0,0% 66,7% 26,7% 0,0%

text: Healthcare 2,9% 8,6% 31,4% 45,7% 2,9% 60,0% 0,0% 68,6% 25,7% 2,9%

text: Online Marketplace 4,0% 24,0% 24,0% 56,0% 0,0% 48,0% 0,0% 52,0% 36,0% 4,0%

text: Transport 0,0% 20,0% 20,0% 45,7% 0,0% 45,7% 0,0% 74,3% 37,1% 0,0%

text: Overall 4,1% 18,0% 23,3% 48,2% 1,2% 49,4% 1,2% 64,1% 33,5% 1,6% Identity and Governance, Business Applications Data Security Vulnerability Network Endpoint Security Access Risk and Continuity Physical Security Management Security Security Analytics Security Management Compliance Management

text: Security incident & event log collection 64% (144) Security awareness & training 63,6% (143) Network Intrusion Detection & Prevention 34,2% (77) Business Continuity Management 32,9% (74) Vulnerability Mgt. 28,4% (64) Security Testing 27,6% (62) Threat intelligence 25,3% (57) Governance, Risk & Compliance 7,6% (17) Multi Factor Authentication 4,9% (11) None. 4,4% (10) Device Encryption and Mgt. 4% (9) Enterprise networks Scans 4% (9) Mobile Deivice Mgt. 2,2% (5) User Behavior Analytics 2,2% (5) Managed Detection & Response 1,8% (4) Next Generation Firewall 1,8% (4) Privileged Account Mgt. 0,4% (1) Physical Security 0,4% (1) Anti-malware or eq. 0,4% (1) Other 0% (0)

text: n = 225 Q: Which of the following technologies or services did you procure because of the NIS Directive implementation? Scope: Organizations with existing or planned NIS program that planned further investments to NIS Directive-related Note: Total does not add up to 100% since multiple answers could be selected by survey respondents

text: December 2020

text: France 2,0% 27,5% 2,0% 5,9% 5,9% 0,0% 5,9% 56,9% 0,0% 5,9% 3,9% 21,6% 2,0% 19,6% 25,5% 56,9% 31,4% 0,0% 3,9% Germany 0,0% 31,4% 0,0% 0,0% 2,0% 2,0% 0,0% 64,7% 0,0% 7,8% 0,0% 27,5% 0,0% 25,5% 29,4% 62,7% 21,6% 0,0% 3,9% Italy 4,0% 28,0% 4,0% 4,0% 8,0% 0,0% 2,0% 54,0% 0,0% 6,0% 2,0% 24,0% 0,0% 36,0% 26,0% 58,0% 26,0% 0,0% 2,0% Poland 0,0% 34,7% 4,1% 2,0% 4,1% 0,0% 4,1% 59,2% 0,0% 8,2% 2,0% 20,4% 4,1% 20,4% 18,4% 57,1% 34,7% 0,0% 2,0% Spain 2,0% 32,0% 0,0% 6,0% 2,0% 0,0% 6,0% 52,0% 2,0% 6,0% 0,0% 20,0% 4,0% 26,0% 24,0% 50,0% 34,0% 2,0% 8,0% Overall 1,6% 30,7% 2,0% 3,6% 4,4% 0,4% 3,6% 57,4% 0,4% 6,8% 1,6% 22,7% 2,0% 25,5% 24,7% 57,0% 29,5% 0,4% 4,0% Next Netw. Intrus. Mobile Device Device Multi Factor Privileged Enterprise Sec. incident Anti- Monitoring & Managed Threat User Behavior Vulnerability Security Security Business Physical None Generation Detection & Management Encryp. & Auth. (MFA) Account Mgt. networks & event log virus/spyware/ Mgt. (SIEM) Detection & intelligence Analytics Mgt. Testing Awareness & Continuity Security Firewall Prevention Mgt. (PAM) Scans collection malware Response Training Mgt. (BCM)

text: Banking 5,0% 30,0% 7,5% 5,0% 12,5% 0,0% 10,0% 52,5% 0,0% 7,5% 2,5% 22,5% 5,0% 30,0% 37,5% 67,5% 37,5% 0,0% 0,0% Cloud computing 0,0% 32,0% 0,0% 4,0% 4,0% 0,0% 4,0% 36,0% 0,0% 8,0% 4,0% 16,0% 4,0% 28,0% 24,0% 68,0% 24,0% 0,0% 4,0% Digital infra. 0,0% 32,0% 0,0% 4,0% 0,0% 0,0% 0,0% 52,0% 0,0% 0,0% 4,0% 16,0% 0,0% 20,0% 20,0% 56,0% 20,0% 0,0% 4,0% Drinking water 0,0% 20,0% 0,0% 13,3% 6,7% 0,0% 0,0% 46,7% 0,0% 13,3% 0,0% 6,7% 0,0% 13,3% 33,3% 40,0% 26,7% 0,0% 6,7% Energy 0,0% 30,0% 0,0% 0,0% 3,3% 3,3% 0,0% 83,3% 0,0% 10,0% 0,0% 33,3% 0,0% 26,7% 16,7% 50,0% 43,3% 0,0% 3,3% Financial market infra. 0,0% 20,0% 0,0% 6,7% 6,7% 0,0% 0,0% 60,0% 0,0% 6,7% 0,0% 40,0% 13,3% 13,3% 33,3% 33,3% 13,3% 0,0% 6,7% Healthcare 2,9% 34,3% 2,9% 0,0% 0,0% 0,0% 2,9% 57,1% 0,0% 5,7% 0,0% 14,3% 0,0% 40,0% 28,6% 60,0% 25,7% 0,0% 0,0% Online Marketplace 4,0% 28,0% 4,0% 4,0% 8,0% 0,0% 8,0% 60,0% 4,0% 4,0% 4,0% 36,0% 0,0% 20,0% 12,0% 60,0% 28,0% 4,0% 8,0% Transport 0,0% 34,3% 0,0% 2,9% 0,0% 0,0% 2,9% 60,0% 0,0% 8,6% 0,0% 22,9% 0,0% 22,9% 22,9% 54,3% 34,3% 0,0% 8,6% Overall 1,6% 30,2% 2,0% 3,7% 4,5% 0,4% 3,7% 57,1% 0,4% 6,9% 1,6% 22,9% 2,0% 25,7% 25,3% 56,7% 29,8% 0,4% 4,1% Next Netw. Intrus. Mobile Device Device Multi Factor Privileged Enterprise Sec. incident Anti- Monitoring & Managed Threat User Behavior Vulnerability Security Security Business Physical None Generation Detection & Management Encryp. & Auth. (MFA) Account Mgt. networks & event log virus/spyware/ Mgt. (SIEM) Detection & intelligence Analytics Mgt. Testing Awareness & Continuity Security Firewall Prevention Mgt. (PAM) Scans collection malware Response Training Mgt. (BCM)

text: December 2020

text: 52% Other regulations prioritized 38,5% 33,3% Stronger local regulations 53,8% 32% Unclear expectations 38,5% 22,7% Limited support from nat. Authority 15,4% 20,9% Multi-department collaboration issues 30,8% 18,7% Lack of resources 34,6% 15,6% Lack of NIS security solutions 7,7% 12,9% Lack of internal skills 30,8% 4,9% No challenge 0%

text: n = 251 Q: In your opinion, what are the main challenges to implement the NIS Directive in your organization? Note: Totals do not add up to 100% since multiple answers could be selected by survey respondents

text: France 23,9% 13,0% 23,9% 23,9% 8,7% 52,2% 58,7%

text: Germany 30,6% 20,4% 16,3% 26,5% 18,4% 49,0% 20,4%

text: Italy 37,0% 8,7% 17,4% 21,7% 28,3% 52,2% 41,3%

text: Poland 36,6% 7,3% 17,1% 14,6% 31,7% 56,1% 22,0%

text: Spain 32,6% 14,0% 18,6% 16,3% 27,9% 51,2% 23,3%

text: Grand Total 32,0% 12,9% 18,7% 20,9% 22,7% 52,0% 33,3%

text: Limited Other Unclear Lack of Collaboration Stronger local Lack of skills support from regulations implications resources issues regulations nat. authority prioritized

text: December 2020

text: Banking 38,5% 10,3% 10,3% 15,4% 7,7% 51,3% 28,2% Cloud computing 9,5% 19,0% 14,3% 14,3% 14,3% 57,1% 33,3% Digital infra. 38,9% 27,8% 50,0% 11,1% 33,3% 44,4% 50,0% Drinking water 36,4% 18,2% 27,3% 18,2% 18,2% 54,5% 18,2% Energy 23,3% 3,3% 3,3% 26,7% 26,7% 50,0% 26,7% Financial market infra. 42,9% 7,1% 50,0% 21,4% 35,7% 42,9% 7,1% Healthcare 30,3% 15,2% 9,1% 33,3% 33,3% 51,5% 48,5% Online Marketplace 27,3% 9,1% 31,8% 4,5% 22,7% 59,1% 54,5% Transport 38,7% 12,9% 6,5% 25,8% 22,6% 51,6% 22,6% Overall 31,5% 12,8% 17,8% 20,1% 22,8% 51,6% 33,3% Limited Other Unclear Lack of Collaboration Stronger local Lack of skills support from regulations implications resources issues regulations nat. authority prioritized

text: December 2020

text: Banking 5,1% 2,6% 92,3% Cloud computing 4,8% 23,8% 71,4% Digital infra. 27,8% 27,8% 44,4% Drinking water 0,0% 36,4% 63,6% Energy 0,0% 0,0% 100,0% Financial market infra. 14,3% 0,0% 85,7% Healthcare 0,0% 12,1% 87,9% Online Marketplace 0,0% 18,2% 81,8% Transport 6,5% 16,1% 77,4% Overall 5,5% 12,8% 81,7% Not Underway Implemented implemented

text: December 2020

text: 10+ 0,4% (1) 9 0% (0) 8 2% (5) 7 2% (5) 6 2% (5) 5 9,2% (23) 4 13,5% (34) 3 23,9% (60) 2 30,7% (77) 1 15,5% (39) 0 0% (0) Don't know 0,8% (2) n = 251 Q: How many resources (FTEs) are responsible for the security incident reporting to your national authority in 2019?

text: More than 5 M€ 0% (0) 1 - 5 M€ 0% (0) 750 K€ - 1M€ 1,6% (4) 500 - 750 K€ 12,7% (32) 250 - 500 K€ 25,5% (64) 100 - 250 K€ 10,8% (27) Less than 100 K€ 6,4% (16) Not experienced major security incident 41,4% (104) Don't know 1,6% (4) n = 251 Q: What are the estimated damages incurred by the last major security incident(s) experienced by your organization?

text: December 2020

text: Banking 5,0% 2,5% 32,5% 27,5% 5,0% 25,0% 2,5% Cloud computing 0,0% 8,0% 20,0% 16,0% 0,0% 56,0% 0,0% Digital infra. 20,0% 4,0% 8,0% 12,0% 0,0% 56,0% 0,0% Drinking water 6,7% 26,7% 13,3% 0,0% 0,0% 53,3% 0,0% Energy 0,0% 0,0% 36,7% 20,0% 0,0% 43,3% 0,0% Financial market infra. 6,7% 26,7% 13,3% 6,7% 0,0% 40,0% 6,7% Healthcare 5,7% 28,6% 37,1% 5,7% 0,0% 22,9% 0,0% Online Marketplace 8,0% 12,0% 12,0% 20,0% 8,0% 36,0% 4,0% Transport 5,7% 5,7% 34,3% 0,0% 0,0% 51,4% 2,9% Overall 6,1% 11,0% 25,7% 13,1% 1,6% 40,8% 1,6% <100 K€ 101 - 250 K€ 251 - 500 K€ 500 - 750 K€ 751 K€ - 1 M€ No major Doesn’t know incident

text: No opinion 0,8% (2)

text: n = 251

text: Q: Please rate the impact of NIS Directive on your organization’s security posture, where 1=Negative Impact; 3=Neutral

text: and 5=Positive impact

text: December 2020

text: France 0,0% 0,0% 11,8% 37,3% 49,0% 2,0% Germany 0,0% 0,0% 9,8% 60,8% 29,4% 0,0% Italy 0,0% 0,0% 22,0% 36,0% 42,0% 0,0% Poland 0,0% 2,0% 20,4% 30,6% 46,9% 0,0% Spain 0,0% 4,0% 16,0% 34,0% 44,0% 2,0% Grand Total 0,0% 1,2% 15,9% 39,8% 42,2% 0,8% No 1 2 3 4 5 opinion

text: Banking 0,0% 0,0% 12,5% 42,5% 45,0% 0,0% Cloud computing 0,0% 0,0% 24,0% 52,0% 24,0% 0,0% Digital infra. 0,0% 8,0% 24,0% 40,0% 24,0% 4,0% Drinking water 0,0% 0,0% 26,7% 40,0% 33,3% 0,0% Energy 0,0% 0,0% 10,0% 16,7% 73,3% 0,0% Financial market infra. 0,0% 0,0% 6,7% 33,3% 53,3% 6,7% Healthcare 0,0% 0,0% 11,4% 40,0% 48,6% 0,0% Online Marketplace 0,0% 0,0% 16,0% 48,0% 36,0% 0,0% Transport 0,0% 2,9% 17,1% 45,7% 34,3% 0,0% Overall 0,0% 1,2% 15,9% 40,0% 42,0% 0,8% No 1 2 3 4 5 opinion

text: December 2020

text: December 2020

text: December 2020

text: FI 10987 PT 1250 DE 573 IT 553 UK 470 SE 326 SK 273 BG 185 PL 142 EE 137 ES 132 DK 128 FR 127 RO 86 HR 85 EL 67 LV 66 Scope of the IE 64 questionnaire CZ 50 LU 49 NL 42 HU 42 MT 36 LT 22 CY 20 SI 0 BE 0 AT 0 0 500 1000 1500

text: December 2020

text: December 2020

text: Banking 15,9% (40) Healthcare 13,9% (35) Transport 13,9% (35) Energy 12% (30) Online Marketplace 10% (25) Digital infrastructures 10% (25) Cloud computing 10% (25) Drinking water sup. & distrib. 6% (15) Financial market infra. 6% (15) Online Search Engine 2% (5) Other 0,4% (1) n = 251 Q: Which of below best describes the industry in which your organization operates?

text: More than 100,000 6,8% (17) 50,000 - 100,000 5,6% (14) 30,000 - 50,000 6,4% (16) 10,000 - 30,000 23,1% (58) 5,000 - 10,000 24,3% (61) 250 - 5000 25,5% (64) Less than 250 8,4% (21) n = 251 Q: What is the estimated number of your organization's full-time employees in 2019?

text: December 2020

text: More than 5 Bn€ 25,5% (64) 1 - 5 Bn€ 32,7% (82) 750 - 1000 M€ 6% (15) 500 - 750 M€ 6,4% (16) 250 - 500 M€ 10% (25) 100 - 250 M€ 4,8% (12) 50 - 100 M€ 3,6% (9) 10 - 50 M€ 7,6% (19) Less than 10 M€ 3,6% (9) n = 251 Q: What is your organization’s estimated revenue range in 2019?

text: IS officer 21,1% (53) COO 16,3% (41) IT manager 16,3% (41) IS manager 14,3% (36) CRO (2) 14,3% (36) BCM (1) 9,6% (24) CIO 6,4% (16) CISO 1,6% (4) CSO 0% (0) Other 0% (0) n = 251 Q: Which of the function below best match your role in your organization? (1) = Business Continuity Manager; (2) = Chief Risk Officer

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

text: December 2020

identifier: NIS Investments Report 2020

nummer: nis-investments

publisher: Europeiska unionens cybersäkerhetsbyrå

sprak: en

title: NIS Investments Report 2020

serie: rapporter

text: DECEMBER 2020 NIS INVESTMENTS

type: rubrik

text: ABOUT ENISA

text: The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and raising awareness, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. For more information, visit www.enisa.europa.eu.

type: stycke

text: CONTACT

text: For contacting the authors please use resilience@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.

text: AUTHORS

text: Athanasios Drougkas, Georgia Bafoutsou, Viktor Paggio EU Agency for Cybersecurity

text: LEGAL NOTICE

text: Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the

text: Regulation (EU) No 2019/881

text: . This publication does not necessarily represent state-of the-art and ENISA may update it from time to time.

text: Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication.

text: This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

text: COPYRIGHT NOTICE

text: © European Union Agency for Cybersecurity (ENISA), 2020 Reproduction is authorised provided the source is acknowledged.

text: For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

text: ISBN 978-92-9204-442-8 - DOI 10.2824/50973

text: NIS INVESTMENTS

text: TABLE OF CONTENTS

text: 1. INTRODUCTION 5 2. INFORMATION SECURITY DYNAMICS AND OUTLOOK 6

text: 2.1 SECURITY BUDGETS 6

text: 2.2 INFORMATION SECURITY SPEND DISTRIBUTION 10

text: 2.3 INFORMATION SECURITY STAFFING 12

text: 2.4 INFORMATION SECURITY MARKET OUTLOOK 13

text: 2.5 TRENDS ON SECURITY INCIDENTS LIABILITY 14

text: 3. INFORMATION SECURITY INVESTMENTS FOR THE NIS DIRECTIVE IMPLEMENTATION 15

text: 3.1 INFORMATION SECURITY SPEND IN THE NIS DIRECTIVE SECTORS 15

text: 3.2 NIS DIRECTIVE IMPLEMENTATION 18

text: 3.2.1 Current state 18 3.2.2 NIS Directive implementation program timeline 19

text: 3.3 NIS DIRECTIVE RESOURCES 22

text: 3.3.1 NIS dedicated budget 22 3.3.2 NIS dedicated hires 25

text: 3.4 NIS DIRECTIVE SECURITY IMPACT 27

text: 3.4.1 Impact on information security domains 27 3.4.2 Impact on procurement of technology and services 28

text: 3.5 NIS DIRECTIVE IMPLEMENTATION CHALLENGES 29

text: 3.6 INFORMATION SECURITY INCIDENTS 31

text: 3.6.1 Information security incident reporting 31 3.6.2 Cost of major information security incidents 33

text: 3.7 PERCEPTION OF THE NIS DIRECTIVE IMPACT 34

text: 4. CONCLUSIONS 36 A ANNEX: SURVEY DEMOGRAPHICS 38

text: A.1 SELECTION OF MEMBER STATES TO FOCUS SURVEY 38

text: NIS INVESTMENTS

text: A.2 SURVEY RESPONDENT DEMOGRAPHICS 39

text: A.3 LOCATION OF SURVEYED ORGANISATIONS 39

text: A.4 SECTORS OF SURVEYED ORGANISATIONS 39

text: A.5 STAFFING AND REVENUE OF SURVEYED ORGANISATIONS 40

text: A.6 ROLE OF SURVEYED INDIVIDUALS 41

text: A.7 TYPES OF SURVEYED ORGANISATIONS 42

text: B ANNEX: DEFINITIONS 43

text: B.1 FINANCIALS 43

text: B.2 INDUSTRIES 43

text: B.3 SECURITY DOMAINS 47

text: B.4 SECURITY ASSET TYPES 49

text: NIS INVESTMENTS

text: EXECUTIVE SUMMARY

text: The Directive on Security of Network and Information Systems (NIS Directive) represents the

text: 82% of surveyed

text: first EU-wide legislation on cybersecurity, with the objective to achieve a high common level of

text: organisations

text: cybersecurity across all European Union (EU) Member States. One of the three pillars of the NIS Directive is the implementation of risk management and reporting obligations for Operators acknowledge a of Essential Services (OES) and Digital Service Providers (DSP). positive impact

text: of the NIS

text: Four years after the NIS Directive entered into force and two years after the transposition by

text: Directive on their

text: Member States into their national laws, this report presents the findings of a survey of 251

text: information

text: organisations across five EU Member States (France, Germany, Italy, Spain and Poland) with regards to NIS investments. The report depicts and analyses how OES and DSPs spend their security information security budget and provides indications as to how this spending has been influenced by the introduction of the NIS Directive. The results of this NIS survey were correlated with Gartner security data and insights observed globally and in the EU in order to better understand the current NIS Directive adoption dynamics and impact on related investments.

text: This report provides comprehensive data and insights regarding the NIS Directive adoption and the effects on the information security budget, staffing, solutions adoption and security posture of organisations within its scope.

text: Overall, 82% of surveyed organisations acknowledge a positive impact of the NIS

text: Directive on their information security.

text: Regarding the NIS Directive implementation, the collected data revealed the following:

text:  More than 80% of surveyed organisations declared that their NIS Directive implementation program is either completed or in progress. The average NIS implementation program is between 14 and 18 months  The average budget for NIS Directive implementation projects is approximately 175 K€, with 42.7% of affected organisations allocating between 100 and 250 K€. A little under 50% of surveyed organisations had to hire additional security matter experts (both internally and through staff augmentation), in the majority of cases hiring up to 4 FTEs  Surveyed organisations prioritised the following security domains: Governance, Risk and Compliance (GRC), Network Security, Business Continuity Management (BCM) and Vulnerability Management (VM).  When implementing the NIS Directive, 64% of surveyed organisations procured security incident & event log collection solutions, as well as security awareness & training services.  “Unclear expectations” and “Limited support from the national authority” are among the top challenges faced by surveyed organisations when implementing the NIS Directive.  81% of the surveyed organisations have established a mechanism to report information security incidents to their national authority, with the majority of surveyed organisations allocating up to 4 people for incident reporting.  Nearly 60% of surveyed organisations reported major information security incidents.  43% of surveyed organisations experienced information security incidents with a direct financial impact up to 500 k€.

text: NIS INVESTMENTS

text: 1. INTRODUCTION

text: The Directive on Security of Network and Information Systems (NIS Directive) represents the first EU-wide legislation on cybersecurity, with the objective to achieve a high common level of cybersecurity for all EU Member States. One of the three pillars of the NIS Directive is the implementation of risk management and reporting obligations for Operators of Essential Services (OES) and Digital Service Providers (DSP). Annex II and Annex III of the NIS Directive identify the following categories of operators / sectors as OES and DSPs respectively:

text: Table 1: Categories of OES and DSPs as defined in the NIS Directive

text: Categories of OES and DSPs

text: OES DSPs

text: The objective of this report is to document how operators in these sectors invest in cybersecurity and how the implementation of the NIS Directive has influenced this investment.

text: NIS investment data for this report was collected from two sources:

text:  High-level insights on the EU cybersecurity market were drawn from Gartner’s Research databases, combined with additional analysis of the current market dynamics and latest forecasts.  To collect specific data on the NIS Directive, an ad hoc survey was conducted on 250+ European organisations identified as OES or DSPs

text: Surveyed organisations originated from five Member States chosen due to the size of their information security market as well as the number of OES and DSPs declared: Germany, France, Italy, Spain and Poland. Additional information on the methodology, rationale for selecting these 5 MS and additional survey demographics is available in Annex A.

text: The target audience of this report are EU and National policy makers. As a secondary audience, this report may provide useful information to OES and DSPs as well.

text: NIS INVESTMENTS

text: 2. INFORMATION SECURITY DYNAMICS AND OUTLOOK

text: This chapter aims to provide a high-level view of the global information security trends and outlook. It leverages data provided by Gartner, uncorrelated to the dedicated survey specifically for NIS investments related to the implementation of the NIS Directive. The specific sources of data for the following analysis include:

text:  Gartner's IT Score for Security Management 2020 survey  Gartner IT Key Metrics Data 2020  Gartner forecast: IT security and Risk Management, Worldwide

text: It should be noted that the source of the data provided in chapter 2 (Gartner databases) is different to the source of the data for chapter 3 (survey). Specifically:

text:  The definitions of the industries in chapter 2 is not the same as the definitions of the OES used in chapter 3. Moreover, data in chapter 2 also covers sectors that are not in the NIS Directive.  The source of data in chapter 2 cover a broad EU Member State (MS) and international scope, whereas data in chapter 3 was collected from OES in 5 MS

text: A detailed description of the relevant definitions is available in Annex B.

text: The reason this dataset is presented before the detailed data related to the NIS Directive implementation is to provide a high level overview of the global market, including EU MS, in terms of information security investments and highlight a few key statistics and trends. This

text: broader view serves as an introduction to the more focused analysis presented in

text: chapter 3 for OES and DSPs in the aforementioned EU Member States.

text: 2.1 SECURITY BUDGETS

text: Data shows that the tracking and associated allocation of IT security budgets is still growing within most organisations. Indeed, it is observed that 38% of surveyed organisations still do not have a distinct security budget and 62% of organisations do not effectively communicate costs associated to information security to business units and process owners.

text: Figure 1: Overview of budget issues

text: NIS INVESTMENTS

text: When looking at the ownership of Information security budgets and the lines of reporting, it can be observed that information security is widely recognised as an IT discipline.

text: Figure 2: Ownership of Information security budgets and the lines of reporting

text: Organisations

text: Data shows that organisations allocate a rather stable share of their IT budget to information security, with a relevant portion of around 6% since 2016. allocate a rather

text: stable share

text: The decline in IT Security spend Vs Overall IT Budget actually reflects an accelerated growth of

text: around 6% of

text: Overall IT Budget vs IT Security spend resulting in a ‘negative’ proportional trend.

text: their IT budget to information security NIS INVESTMENTS

text: Figure 3: Global IT security spending as a share of total IT budget

text: When comparing organisations from the EU to organisations from the United States of America, data shows that EU organisations allocate on average 41% less to information security than their American counterparts.

text: Figure 4: IT security spending as a share of total IT budget by geography

text: The below breakdown analysis per industry highlights major discrepancies between different sectors. The three industries with the highest Information Security (IS) spend as a percentage of their overall IT budgets are Banking, Financial Services and Pharmaceuticals organisations, with a ratio higher than 5%. Transportation, Education and Retail are the sectors with the lowest such ratios, all below 2,5%.

text: NIS INVESTMENTS

text: Figure 5: IT security spending as a share of total IT budget by industry

text: NIS INVESTMENTS 2.2 INFORMATION SECURITY SPEND DISTRIBUTION

text: The analysis of the information security budget distribution across various information security domains (see appendix for the definition of the information security domains) gives further insights to the type of investment organisations are making .

text: In summary:

text:  Vulnerability management and security analytics investments focus on proactive capabilities for minimising the impact of any breaches once they have occurred.  Application security is how the application was designed and developed, how it’s operated, and how the application and its supporting elements (network, OS, database etc.) are configured and deployed to ensure security.  Governance, risk, and compliance management (GRC) focuses on how organisations deal with their unique set of risks by developing strategies, policies, standards and awareness that underpin security services. GRC ensures that risk is managed openly and effectively, that legal and regulatory compliance requirements are met and that information security is embedded throughout the organisation  Network security, Identity and Access Management (IAM), endpoint security and data security are part of the operational infrastructure security, which focuses on protecting the network, hosts and data and on ensuring secure access to systems for authorised users.

text: Data indicates that the top 3 domains in terms of spending are:

text:  Vulnerability Management and Security Analytics with a share of 20%  Governance, Risks and Compliance (GRC) with a share of 18%  Network Security with a share of 17%

text: This distribution between the different functional areas has been quite stable over the last four years, but, although quite similar when comparing organisations in the EU and US, varies greatly between industries.

text: Figure 6: IT security spending distribution by functional area

text: NIS INVESTMENTS

text: In terms of asset class, it is observed that the main area of spending for information security is Personnel (37%), followed by Software (27%) and Hardware (21%). The share of external services such as advisory, outsourcing or cloud services is only 15%.

text: Figure 7: IT security spending distribution by asset class

text: NIS INVESTMENTS 2.3 INFORMATION SECURITY STAFFING

text: The demand for information security trained resources is very high and still growing. Many organisations are facing real issues in hiring resources with the required skillset & experience.

text: As such, it is foreseen that the number of unfilled information security positions will reach 3.5 million globally by 2022, going up from 1 million in 2016.

text: Figure 8: Information Security Staffing

text: Even though the demand for security resources is already high and growing, due to the ongoing scarcity of these resources in the market, the share of information security resources within the overall IT staff does not increase.

text: As of 2020, information security staff represents 5,6% of total IT staff, measured in terms of FTEs. (Information security personnel includes in-house and contract full-time equivalents supporting the IT security domains).

text: Figure 9: Information Security FTEs as a share of total IT staff

text: On top of the overall lack of security resources, there is also a change in the security skills that are in demand. This change directly reflects the increasing use of automation in information security.

text: Skills that were in high demand in the previous years such as Manual Penetration Testing, Tier 1/2 SOC Analysis or Technology Management are now decreasing in value and are being replaced by skills in Risk Management, Service Management, Incident Response, Threat Intelligence, Data Science and Analysis or Coding.

text: NIS INVESTMENTS

text: Figure 10: Change the security skills demand

text: 2.4 INFORMATION SECURITY MARKET OUTLOOK

text: Forecasted growth rates for 2020 through 2024 have recently been substantially revised in alignment with the revised outlook driven by post-COVID-19 IT spending. Figure below shows the overall information security and risk management spending and the compound annual growth rate (CAGR) for 2019 through 2024.

text: Figure 11: IT security Forecast — Compound Annual Growth Rate (CAGR), 2019 - 2024 (%)

text: NIS INVESTMENTS

text: The fastest growing security segment is Cloud Access Security Brokers (CASB), albeit being one of the smallest security segments listed. The reason cloud security continues to grow, even in these difficult economic times, is largely because of its role in digital transformation, protecting data and user access to Software as a Service (SaaS) services. As organisations look to support remote workers and continue to move business services to the cloud, CASB is a key part of that security strategy.

text: Another security segment that is continuing to grow despite the current economic situation is the Identity and Access Management segment, including four sub-segments: Access Management (AM), Identity Governance and Administration (IGA), Privileged Access Management (PAM), and User Authentication. Indeed, organisations need to provide secure access to their remote workforce users, including IT users with privileged access. The use of cloud technologies has also shifted the need from a perimeter-based approach to an identity and context-based approach.

text: 2.5 TRENDS ON SECURITY INCIDENTS LIABILITY

text: It is forecasted by Gartner that by 2024 liability for cyber physical systems (CPS) incidents (impacting human safety or the environment) will break through the corporate protective barrier to personal liability for 75% of CEOs.

text: Regulators and governments around the world are expected to strengthen laws and regulations for CPS as they are viewed as critical systems where incidents can result in physical harm to people, destruction of property or environmental disasters.

text: This trend may result CEOs no longer being able to hide behind complex corporate organisational hierarchies, a potential ‘lack of knowledge’, processes, or insurance policies. This will be the case particularly in asset-intensive, critical infrastructure and clinical healthcare environments that extensively use CPS, or for organizations that sell CPS to others.

text: An example of this trend is the Corporate Executive Accountability Act introduced in the U.S. Senate in 2019 . This development would render CEOs liable for their companies' failure to implement basic security measures that would have prevented a fatal CPS incident.

text: If not through a legal action, CEOs may find themselves responsible in front of the shareholders. There already exists several recent examples: The Yahoo breach settlement opened the doors to company officers being directly sued by shareholders. The judge in the legal proceedings following the Equifax breach refused to dismiss a suit against the former company CEO ; a suit against the company Chegg and its CEO claiming they failed to disclose a lack of security measures has been filed ; and Marriott International shareholders filed a similar suit against that company’s officers .

text: NIS INVESTMENTS

text: 3. INFORMATION SECURITY INVESTMENTS FOR THE NIS DIRECTIVE IMPLEMENTATION

text: 3.1 INFORMATION SECURITY SPEND IN THE NIS DIRECTIVE SECTORS

text: The surveyed organisations represent a large range of information technology budgets, ranging from SMEs devoting less than 5 M€ to IT, to multinational corporations with more than one billion euros of IT spending, reflecting the diversity of actors identified as OES and DSPs by national authorities.

text: Figure 12: IT budget range of surveyed organisations

text: NIS INVESTMENTS

text: Figure 13: IT budget range of surveyed organisations by industry

text: This diversity can also be observed in the ranges of Information Security budgets, ranging from less than 100 K€ to above 100 M€, with the highest percentage of Information Security budget range among the surveyed organisations being 10 – 25 M€.

text: Figure 14: Information security budget range of surveyed organisations

text: NIS INVESTMENTS

text: Figure 15: Information security budget range of surveyed organisations by sector

text: The analysis of the financial data shows that there is a strong correlation between overall IT budget and Information Security budget, as organisations with a higher IT budget will also The Information spend more in information security. Security budget

text: Figure 16: Information Security budget vs. overall IT budget for surveyed organisations

text: NIS INVESTMENTS 3.2 NIS DIRECTIVE IMPLEMENTATION 3.2.1 Current state

text: As of November 2020, more than 80% of surveyed organisations declared that their NIS Directive implementation program is either completed or in progress and 8% of surveyed organisations plan to implement the NIS Directive but have not started yet. For the 10% remaining that do not intend to launch a dedicated program or projects, less than 1% actually do not plan to implement the NIS Directive at all, while the rest will leverage some of its key requirements to improve and guide their information security practices. Figure 17: Current state of NIS Directive implementation among surveyed organisations

text: Minor differences can be observed when comparing the NIS Directive implementation status between operators in different MS. An interesting find is that 10% of all surveyed organisations are not following an NIS Directive implementation program but are using the NIS Directive as best practice. Figure 18: Current state of NIS Directive implementation per country

text: NIS INVESTMENTS

text: The analysis also shows additional differentiation between sectors as regards the

text: Over 75% of

text: implementation of the NIS Directive. For instance, more than three quarters of surveyed

text: surveyed

text: organisations in the Banking and Energy sectors have fully implemented the Directive, well above the cross-sector average (58.8%). organisations in

text: the Banking and

text: Furthermore the percentage of surveyed organisations that declared they will not directly Energy sectors implement the NIS Directive, but will instead leverage its principles as best practices, varies

text: have fully

text: substantially across the different sectors.

text: implemented the

text: Figure 19: Current state of the NIS Directive implementation per sector Directive, well

text: above the crosssector average 3.2.2 NIS Directive implementation program timeline

text: The majority of organisations falling under the provisions of the NIS directive report having launched implementation projects by the end of 2019 (64,2% of surveyed organisations), and nearly a third by the end of 2018, year of transposition into nation law and identification of OES and DSPs. With 16,4% of organisations having started the implementation in 2020, there remains an 8% of organisations that will implement the NIS Directive in the future, from 2021 onwards. Furthermore, the analysis shows that implementation projects of the NIS Directive typically last between 14 and 18 months, with little differentiation between countries or sectors.

text: NIS INVESTMENTS

text: Figure 20: Duration of NIS Directive implementation program among surveyed organisations (in months)

text: Figure 21: Start year of NIS Directive implementation program among surveyed organisations

text: 2017 1,3% (3) 2018 36% (81) 2019 38,2% (86) 2020 16,4% (37) 2021 6,7% (15) 2022 or later 1,3% (3) n = 225 Q: What are the start date and estimated duration of the NIS program or projects? Scope: Organizations with existing or planned NIS program Variance between countries in terms of project initiation start dates can be explained by timeline differences in the transposition of the NIS Directive into national laws, including the publication of detailed requirements .

text: NIS INVESTMENTS

text: Figure 22: NIS Directive implementation program start year per country

text: The analysis of the start year per sector correlates with previous findings indicating that operators from the Banking and Energy sectors were ahead of the curve in terms of implementation: more than 50% of organisations started their NIS Directive programs in 2018, compared with an average baseline of approximately a third among all sectors.

text: Figure 23: NIS Directive implementation program start year per sector

text: NIS INVESTMENTS 3.3 NIS DIRECTIVE RESOURCES 3.3.1 NIS dedicated budget Disclaimer: for the following financial figures, it is important to bear in mind the following limitations.  While low levels of investments cannot be sustained without adverse impact on the information security readiness, higher spending does not necessarily correlate with an associated improved maturity  Certain cybersecurity expenditures are not accurately captured such as secure-by-design ICT products and services, that elevate the overall security level of an organisation, but do not fall under specialised security-related budgets

text: The average budget for NIS Directive implementation projects is approximately 175 K€, with 42.7% of affected organisations allocating between 100 and 250 K€. Such amounts typically represent a low share of the organisations’ overall Information Security budgets.

text: Figure 24: Dedicated NIS Directive budget among surveyed organisations

text: The NIS Directive dedicated budgets are broadly similar and mostly fall in the 100 to 250 K€ range across all countries in scope of the survey.

text: NIS INVESTMENTS

text: Figure 25: Dedicated NIS Directive budget per country

text: Outside of the 100-250 K€ central budget range, Energy OES seem to allocate larger sums to NIS Directive programs compared to other sectors: nearly half of these OES allocate more than

text: 250 K€, vs. less than 25% on the overall average of affected organisations.

text: Figure 26: Dedicated NIS Directive budget per sector.

text: NIS INVESTMENTS

text: The analysis of the NIS security program budget against the organisations’ information security budget shows a correlation between the two figures, though more limited than the link existing between information security budget and IT budget as reflected in Figure . This is mostly due to the fact that more than 80% of surveyed organisations allocated less than 1 M€ of budget to their NIS-related security program.

text: Figure 27: NIS Directive implementation budget vs. overall information security budget for surveyed organisations

text: NIS INVESTMENTS 3.3.2 NIS dedicated hires

text: The majority of affected organisations did not require additional staff to implement the NIS Amongst Directive (50.7% of total respondents). Among those that did, ~29% filled that need by hiring organisations that new staff, while the remainder had recourse to external contractors (20.4% of total

text: employed

text: respondents).

text: additional staff to implement the NIS

text: Amongst organisations that employed additional staff to implement the NIS Directive, the large majority recruited up to 4 people. Directive, the large

text: majority recruited

text: Figure 28: NIS Directive-related hires amongst surveyed organisations

text: up to 4 people.

text: This observation is valid across the EU MS in scope of the survey. Poland is the country where the NIS Directive was mostly implemented with internal resources. On the other side, organisations in Italy and France resorted more to new hires, while organisations in Germany and Spain made a more intensive use of external contractors.

text: Figure 29: Additional staff hired to implement the NIS Directive per country

text: NIS INVESTMENTS

text: Banking, Healthcare and Energy OES were more likely to have hired additional staff to implement the NIS Directive (respectively 43,6%, 42,4% and 40,0% vs. 29,7% on average).

text: Conversely, organisations in the Cloud computing, Transport and Online marketplace sectors appear to have relied the least on additional staff.

text: Figure 30: Additional staff hired to implement the NIS Directive per sector

text: Figure 31: Number of additional staff hired to implement the NIS Directive among surveyed organisations

text: NIS INVESTMENTS 3.4 NIS DIRECTIVE SECURITY IMPACT 3.4.1 Impact on information security domains

text: According to surveyed organisations, the most frequently cited domains impacted by the NIS Directive implementation are:

text:  Governance, Risks and Compliance (64.5%), which was to be expected since the

text: NIS Directive itself is a legislative document.  Network Security (48.6%), which can be explained by the NIS provisions on security

text: incidents detection and reporting requirements.  Business Continuity Management (33.1%), also related to the management of

text: security incidents.

text: Figure 32: Information security domains prioritised for NIS investments among surveyed organisations

text: Figure 33: Information security domains prioritised for NIS investments per country

text: NIS INVESTMENTS

text: Figure 34: Information security domains prioritised for NIS investments per sector

text: 3.4.2 Impact on procurement of technology and services

text: It is worth noting that NIS Directive investments did not seem to focus on new technologies. The services most cited in the survey as NIS investment targets are:

text:  Security incident & event log collection (64%), with an obvious relation to security

text: incident reporting requirement provisions of the Directive.  Security Awareness & training (63.6%)

text: Figure 35: Technologies and services procured to implement the NIS Directive

text: NIS INVESTMENTS

text: Figure 36: Technologies and services procured to implement the NIS Directive per country

text: Figure 37: Technologies and services procured to implement the NIS Directive per sector

text: 3.5 NIS DIRECTIVE IMPLEMENTATION CHALLENGES

text: Almost all OES and DSPs surveyed reported having faced at least one serious challenge while implementing the NIS Directive. Irrespective of organisations’ current implementation state, the challenges that were most cited were the following:

text:  The prioritisation of other regulations e.g. GDPR.  The existence of stronger local regulations e.g. France’s “Loi de Programmation Militaire” (LPM).  The lack of clarity of the NIS Directive expectations after transposition into national law.

text: However, as regards the organisations that do not have a dedicated NIS Directive implementation project, then internal challenges rise to prominence: the lack of resources (34.6% of such respondents), lack of skills (30.8%) or lack of collaboration (30.8%).

text: NIS INVESTMENTS

text: Figure 38: Main challenges in implementing the NIS Directive amongst surveyed organisations

text: For all countries in scope of the survey, the prioritisation of other regulations is the most frequently cited challenge to implement the NIS Directive, with the exception of France, for which organisations cited the existence of stronger regulations, such as the LPM.

text: The lack of clarity in the expectations of national competent authorities is also a relatively common denominator in all countries, with around 30% of organisations on average citing it as a challenge to implement the NIS Directive.

text: Figure 39: NIS Directive implementation challenges per country

text: NIS INVESTMENTS

text: For the large majority of sectors, other regulations pose the main challenge faced when implementing the NIS Directive, whether due to their prioritisation or the existence of stronger local rules / regulatory requirements. A sizeable share of Digital infrastructure, Financial Market Infrastructure and to a lesser extent Online Marketplace organisations state the scarcity of resources devoted to the NIS Directive as challenge to its implementation. Finally, the implications of the NIS Directive seem well grasped by Cloud computing organisations, as less than one in ten cite it as a challenge to set up the Directive, compared to nearly a third of all NIS affected organisations across the rest of the sectors. Figure 40: NIS Directive implementation challenges per sector

text: 3.6 INFORMATION SECURITY INCIDENTS 3.6.1 Information security incident reporting

text: Survey data reveals that the NIS Directive requirements regarding information security incident management mechanisms are in place for most OES and DSP organisations: more than 80% have already implemented these mechanisms, with an additional 13.3% of surveyed organisations declaring to have their implementation underway with little variation between the MS in scope of the survey. This widespread adoption can be at least partly explained by the relative low number of personnel involved: more than 70% of affected organisations allocate up to 4 people to this task.

text: NIS INVESTMENTS

text: Figure 41: Implementation of information security incident management mechanisms among surveyed organisations

text: Mechanisms for information security incident management are largely in place for the majority of sectors.

text: Figure 42: Implementation of information security incident management mechanisms per sector

text: NIS INVESTMENTS

text: Figure 43: Staff responsible for information security incident reporting among surveyed organisations (FTEs)

text: 3.6.2 Cost of major information security incidents

text: Among surveyed organisations, 58.6% did report major information security incidents. Among those organisations, the majority of respondents reported associated costs between 250 and

text: 500 K€, without significant discrepancy when comparing between the EU MS in scope of the survey.

text: Figure 44: Major information security incident financial impact among surveyed organisations

text: Cloud computing, Digital infrastructure, Drinking water distribution and Transport are the sectors least affected major information security incidents based on the survey responses, while the sectors most affected are the Banking and Healthcare sectors.

text: The severity of the incidents appeared higher in organisations from Banking and Online marketplaces: respectively 32.5% and 28% of those organisations experienced incidents incurring more half a million euros of costs, versus less than 15% on average.

text: NIS INVESTMENTS

text: Figure 45: Major information security incident financial impact per sector

text: 3.7 PERCEPTION OF THE NIS DIRECTIVE IMPACT

text: Survey data shows that the large majority of affected organizations tend to have a positive assessment of the NIS Directive contribution to their security posture. On a scale from 1 (low) to

text: 5 (high), 82% of surveyed organisations gave the NIS Directive a mark of 4 or above. This positive assessment can be found irrespective of the EU MS or the sector concerned.

text: Figure 46: Appreciation of survey respondents of the NIS Directive impact on their information security posture

text: NIS INVESTMENTS

text: Figure 47: Appreciation of the survey respondents of the NIS Directive impact on their information security posture per country

text: Figure 48: Appreciation of the survey respondents of the NIS Directive impact on their information security posture per sector

text: NIS INVESTMENTS

text: 4. CONCLUSIONS

text: The data collected and processed for this report produced a number of interesting findings leading to some conclusions on the nature of NIS investments across different sectors and countries, as well as how the relevant spend among EU OES and DSPs has been influenced over the last few years by the NIS Directive. A summary of the main conclusions is presented below.

text: When analysing information security spending in a global, cross-industry scale (section 2.1), it can be observed that organisations average around 6% of their overall IT budget to information security, a percentage that has remained fairly stable since 2016. Discrepancies do exist when comparing organisations in different countries with EU organisations allocating on average 41% less to information security than their American counterparts. Discrepancies in information security spending are even more apparent between different sectors with certain sectors investing in information security a percentage of their IT budget up to 5-6 times higher than that invested by sectors with the lower information security spending profiles.

text: Section 2.2 illustrates how the information security budgets are spent and reveals that the average spending profile of EU and US organisations is very similar though spending can significantly vary across different sectors. Solutions related to Vulnerability Management and Analytics were found to comprise from 8% up to 35% of the organisations' overall information security budget when comparing different sectors. Smaller variations of the relevant percentage across sectors can be observed when looking at other information security products and services, such as Identity and Access Management (7% - 15%) and Network Security (11% - 28%). Section 2.4 presents the outlook of the information security market and identifies Cloud Access Security Brokers (CASB) as the fastest growing security segment is, reflecting the increased adoption of cloud in all sectors. Another key growing domain is Identity and Access Management, including Access Management (AM), Identity Governance and Administration (IGA), Privileged Access Management (PAM), and User Authentication. Indeed, organisations need to provide secure access to their remote workforce users, including IT users with privileged access, a requirement that has been further emphasised with the new modus operandi resulting from the on-going pandemic.

text: Figure 7 shows that the main area of spending for information security is Personnel (37%), followed by Software (27%) and Hardware (21%). In terms of personnel, as of 2020, information security staff represents 5,6% of total IT staff, measured in terms of FTEs (information security personnel includes in-house and contract full-time equivalents supporting the IT security domains), as further detailed in section 2.3. While this percentage has remained relatively stable over the past 5 years there has been a change in the security skills that are in demand. Skills that were in high demand in previous years such as Manual Penetration Testing, Tier 1/2 SOC Analysis or Technology Management are now decreasing in value and are being replaced by skills in Risk Management, Service Management, Incident Response, Threat Intelligence, Data Science and Analysis or Coding.

text: The EU organisations surveyed (OES and DSPs) declared a broad range of information security budgets, ranging from less than 100 K€ to above 100 M€, with the highest percentage of information security budget range among the surveyed organisations being 10 – 25 M€. There is a strong correlation between overall IT budget and Information Security budget, as organisations with a higher IT budget will also spend more in information security (section 3.1).

text: NIS INVESTMENTS

text: Section 3.2 presents additional information related to the NIS Directive implementation and shows that, as of November 2020, more than 80% of surveyed organisations declared that their NIS Directive implementation program is either completed or in progress and 8% of surveyed organisations plan to implement the NIS Directive but have not started yet. When comparing across the different sectors of the NIS Directive, some sectors appear to be more relatively ahead in terms of its implementation. Furthermore the percentage of surveyed organisations that declared they will not directly implement the NIS Directive, but will instead leverage its principles as best practices, varies substantially across the different sectors. An interesting find is that 10% of all surveyed organisations are not following an NIS Directive implementation program but are using the NIS Directive as best practice. The start year of the NIS Directive implementation program varies between the MS in scope of the survey, a fact that can be attributed to different timelines in the transposition of the NIS Directive into national laws. However, implementation projects of the NIS Directive typically last between 14 and 18 months, with little discrepancies between countries or sectors.

text: The average budget for NIS Directive implementation projects is approximately 175 K€, with 42.7% of affected organisations allocating between 100 and 250 K€, representing a relatively low share of the organisations' overall information security budgets (section 3.3.1). This budget remains similar when examining across different MS but varies slightly when comparing different sectors. The majority of organisations did not require additional staff to implement the NIS Directive (50.7%). Among those that did, ~29% filled that need by hiring new internal staff with the large majority recruiting up to 4 people. Discrepancies can be observed both across different MS, as well as across sectors (section 3.3.2).

text: Data presented in section 3.4 shows that the most frequently cited domains impacted by the NIS Directive implementation are Governance, Risks and Compliance (64.5%), Network Security (48.6%) and Business Continuity Management (33.1%). NIS Directive investments did not seem to focus on new technologies. The services most cited in the survey as NIS investment targets were Security incident & event log collection (64%) and Security Awareness & training (63.6%).

text: Section 3.5 indicates that almost all OES and DSPs surveyed reported having faced at least one serious challenge while implementing the NIS Directive. Irrespective of organisations’ current implementation state, the challenges that were most cited were the prioritisation of other regulations, the existence of stronger local regulations and the lack of clarity of the NIS Directive expectations after transposition into national law. However, for organisations that do not have a dedicated NIS Directive implementation project internal challenges such as the lack of resources (34.6% of such respondents), lack of skills (30.8%) and lack of collaboration (30.8%) appear to be most important. Overall, 82% of surveyed organisations acknowledge a positive impact of the NIS Directive on their security program.

text: Finally, section 3.6 presents data collected on information security incidents. According to the data, 81% of the surveyed organisations have established a mechanism to report information security incidents to their national authority, with the majority of surveyed organisations allocating up to 4 resources for incident reporting. Nearly 60% of surveyed organisations reported major information security incidents with 43% of them having experienced information security incidents with a direct financial impact up to 500 k€.

text: The data and accompanying analysis presented in this report offers some insights on NIS investments among EU OES and DSPs and how these investments have been influenced by the NIS Directive. Hopefully, this data will prove useful to policy makers at an EU and National level to better understand the impact of the NIS Directive and its implementation and reflect upon it to identify and focus future policy initiatives.

text: NIS INVESTMENTS

text: A ANNEX: SURVEY DEMOGRAPHICS

text: This Annex present additional information on the demographics of the survey used to collect the data presented in Chapter 3.

text: A.1 SELECTION OF MEMBER STATES TO FOCUS SURVEY

text: In order to secure a representative size of sample per country and respect the timeline associated with this report, the survey was performed on five Member States (Germany, France, Italy, Spain and Poland) selected based on the following criteria:

text:  National GDP.  Estimated Information Security market size.  Number of declared organizations in the scope of the NIS Directive (see figure below).  Inclusion of one country representative of more recent Member States.

text: Figure 49: OES identified by Member States across all sectors

text: NIS INVESTMENTS A.2 SURVEY RESPONDENT DEMOGRAPHICS

text: 251 EU organisations identified as either operators of essential services (OES) or digital service providers (DSP) participated in the survey.

text: A.3 LOCATION OF SURVEYED ORGANISATIONS

text: Five Member States were selected for this survey: Germany, France, Italy, Spain and Poland. They were selected with regards to the size of their information security market as well as the number of OES and DSPs identified. The selection of surveyed organisations was designed to respect a balanced geographical distribution between the selected countries.

text: Figure 50: Distribution of surveyed organisations by country of origin

text: A.4 SECTORS OF SURVEYED ORGANISATIONS

text: The selection criteria for surveyed organisation were designed to align as closely as possible with the sectors in scope of the NIS Directive, namely:

text:  Online Search Engine  Financial market infrastructures (trading venues, central counterparties)  Drinking water supply and distribution  Cloud computing  Digital infrastructures (internet exchange points, domain name system service providers, top level domain name registries)  Online Marketplace  Energy (electricity, oil and gas)  Transport (air, rail, water and road)  Healthcare  Banking

text: NIS INVESTMENTS

text: Figure 51: Distribution of surveyed organisations per sector

text: A.5 STAFFING AND REVENUE OF SURVEYED ORGANISATIONS

text: No specific quotas were set as to the size or revenues of the surveyed organisations as long as they were considered in scope of the NIS Directive.

text: Figure 52: Distribution of surveyed organisations by headcount

text: NIS INVESTMENTS

text: Figure 53: Distribution of surveyed organisations by revenue (2019)

text: A.6 ROLE OF SURVEYED INDIVIDUALS

text: Collecting precise facts and figures for this study required the ability to reach out to individuals in each organisation that are knowledgeable in the field of cybersecurity and specifically in the implementation of the NIS Directive.

text: Consequently, most of the individuals that were qualified to take part in the survey have direct or indirect links with Information Security departments.

text: It should be noted that the prevalence of COO (Chief Operating Officer) among respondents can be explained by the fact that in many organisations Information Technology falls under their responsibility.

text: Figure 54: Distribution of surveyed individuals by role

text: NIS INVESTMENTS A.7 TYPES OF SURVEYED ORGANISATIONS

text: The most important selection criteria for this survey was the applicability of the NIS Directive. The 251 organizations included in the survey results all declared to be considered Operator of Essential Services (OES) or Digital Service Providers (DSP) by their respective national competent authorities.

text: Figure 55: Distribution of surveyed organisations by type of NIS Directive entity

text: NIS INVESTMENTS

text: B ANNEX: DEFINITIONS

text: This Annex provides definitions for the industries, security domains and other terms used in Chapter 2, in accordance with the relevant Gartner database definitions.

text: B.1 FINANCIALS

text:  Operational Expense is defined as: the total expense associated with the business units supported by the IT organization. This includes items such as selling, general and administrative expenses, cost of goods sold (or cost of revenue), research and development, depreciation, and depletion and amortization expenses. For insurance, this includes underwriting expenses, loss and loss-adjustment expenses; for banking organizations, it includes interest expenses and noninterest expenses; for government and non-profit organizations, it is represented by the enterprise operating budget.

text:  Total IT Spending is defined as: total spending at the end of the 12-month budget period for IT to support the enterprise. IT spending/budget can come from anywhere in the enterprise that incurs IT costs, and it is not limited to the IT organization. It includes estimates by enterprises on decentralized IT spending and or "shadow IT." It is calculated on an annualized 'cash flow view' basis, and, therefore, contains capital spending and operational expenses, but not depreciation or amortization.

text: B.2 INDUSTRIES

text:  Banking and Financial Services –Organizations from which their primary revenue stream is derived from one or more of the following: – Banking: Commercial Banks, Diversified Banks, Central Depository Reserve Institutions, Federal Reserve Banks, International Trade Financing, Private and Industrial Banking, Regional Banks, National and State Commercial Banks, Thrifts and Mortgage Finance. – Other Financial Services – Diversified Financials, Capital Markets, Asset Management and Custody Banks, Investment Funds, Investment Banking, Loan Syndication Services, Merger and Acquisition Advisory Services, Private Placement Advisory Services, Debt and Equity Underwriting Services, Investment Brokerage Services, Investment Advice, Institutional Investment Advice, Personal Investment Advice, Securities and Commodities Markets Services, Commodity Contract Services, Commodity Brokers, Commodity Contract Pool Operators, Commodity Contract Trading Organizations, etc.

text:  Education - Organizations from which their primary revenue stream is derived from one or more of the following: – Higher Education – Colleges, Universities, and Junior Colleges. – Other (Professional Schools, Elementary and Secondary Schools, Vocational Schools, Specialty Educational Services. Automobile Driving Instruction, Child Day Care Services, Educational Curriculum Development, Exam Preparation and Tutoring, Online Education Courses, Online Training Services)

text: NIS INVESTMENTS

text:  Energy - Organizations from which their primary revenue stream is derived from one or more of the following: – Energy Services, Oil and Gas Drilling, Oil Rig Services, Oil and Gas Field Services, Oil and Gas Exploration and Production, Oil and Gas Exploration Services, Mixed, Manufactured, and Liquefied Petroleum Gas Production, Oil and Gas Extraction. – Oil and Gas Refining and Marketing, Petroleum and Petroleum Products, Crude Petroleum and Natural Gas, Gasoline, Lubricating Oils and Greases, Natural Gas Liquids, Petroleum Refining. – Oil and Gas Storage and Transportation, Natural Gas Pipelines, Oil and Gas Pipelines.

text:  Natural Resources - Organizations from which their primary revenue stream is derived from one or more of the following: – Gold, Gold Ores, Silver Ores, Precious Metals and Minerals, Non-metallic Mineral Mining, Precious Gemstone Mining and Production Precious Metal Ores, etc. – Rolling, Drawing, and Extruding of Diversified Metals, Diversified Metal Foundries and Castings, Copper Foundries, Diversified Metal Die-Castings, Injection Molding and Die Casting, Drawing and Insulating Of Diversified Metal Wire, Copper Wire Drawing, Fiber Optic Cable, Rolling, Drawing, and Extruding of Copper, Copper Powder, Paste and Flakes, Smelting and Refining of Diversified Metals. – Agricultural Services, Animal Services, Horses and Equines Services and Breeding, Livestock Services, Crop Services.

text:  Government Organizations from the National Governments, International Organizations performing government services, as well as Government Affiliated Organizations.

text:  Healthcare Providers – Healthcare Facilities, Assisted Living Facilities and Services, Nursing Homes, Retirement Communities, Hospitals and Healthcare Centers, Veterinary Services and Animal Hospitals, Healthcare Services, Dental Services, Home Healthcare Services, Midwifery and Child Birth Preparation Services, Nursing Services, Specialist Services, Chiropractic Services, Optometry Services, Healthcare Referral Services. – Medical Laboratory Services, Mental Care Facilities, Rehabilitation Services, Occupational Therapy Services, Physical Therapy Services, Speech and Language Therapy Services, Medical Practice Organizations, Physician Practice Management Organizations, Primary Care Practitioner Services, Ambulance Services.

text:  Pharmaceuticals and Life Sciences – Pharmaceuticals, Generic Pharmaceuticals, Hormones and Hormone Antagonists, Vaccines, Medicinal Chemicals and Botanical Products, Non-Prescription Drugs, Veterinary Drugs, Vitamins and Nutritional Supplements. – Pharmaceutical Contract Laboratories, Pharmaceutical Contract Manufacturing Services, Pharmaceutical Contract Research Organization, Pharmaceutical Research and Development. – Biotechnology, Agricultural Biotechnology, Biological Products, Biotechnology Research Equipment Manufacturers, Combinatorial Chemistry and Other Lead Generating Technologies, Drug Delivery Technologies, Gene Research and Development, In Vivo (in the body) Diagnostic Substances, Microbiology, Orthbiological Products, Protein and Genome Sequence Products, rDNA Pharmaceuticals, Life Sciences Tools and Services.

text: NIS INVESTMENTS

text:  Professional Services – Commercial Services: Commercial Rental and Leasing Services for Office Equipment, Computers, Passenger and Cargo Aircraft, Construction, Oil and Gas, and Other Machinery. Commercial Design Services, Commercial Interior Design, Fashion and Other Design Services, Commercial Photography. Advertising services for Broadcast, Internet, Radio, Television, Direct Mail, Point of Sale, and Print, Marketing Services, Marketing Consulting, Market Research, Public Relations Services, Investor Relations Services, Telemarketing and Services. General Management Services, Facilities Support Management Services, Risk Management Services, Outsourced Business Services, Security and Safety Services, Human Resource and Employment Services, Human Resources and Personnel Management, Professional and Management Development Training, Secretarial Services, Temporary Help Supply, Online Recruiting and Job Listing Services. Real Estate Investment Trusts (REITs), Real Estate Management and Development, – Research and Consulting Services, Legal Services,, Social Sciences and Humanities Research, Non Healthcare Related Testing Laboratories, IT Services, Data Processing and Outsourced Services, Infrastructure Services, Application Management, Computer Facilities Management Services, Data Management, Data Recovery, Data Storage Services, Infrastructure Consulting, Remote Data Backup, Data Processing and Entry Services, Data Warehousing, Enterprise Resource Planning (ERP), Hardware Services – Residential Design Services, Residential Interior Services, Residential Security and Personal Safety Services, Ticket Sales, Sanitary Services, Cesspool and Septic Tank Cleaning, Hazardous Waste Collection, Diet and Weight Reducing Services, Consumer Electronics Repair Services, Camera Repair, Radio and Television Repair, Telephone and Communications Equipment Repair, Electrical Repair, Refrigeration and Air Conditioning Repair, Reupholstery and Furniture Repair – Environment, Conservation, and Wildlife Organizations, Humane Societies, Membership Organizations, Business Associations, Civic, Social, and Fraternal Associations, Farm Business Organizations, Labor Unions and Labor Organizations, Professional Membership Organizations, Political Organizations

text:  Retail and Wholesale – Internet and catalogue retail, Department Stores, General Merchandise Stores, Apparel Retail, Motor Vehicle Retail, Motor Vehicle Renting and Leasing, Motor Vehicle Repair and Services. Oil and Gas Retail, Fuel and Bottled Gas dealers, Gas Stations, Computers, Software, Electronics, and Camera Retail, Home Furnishing and Home Improvement Retail, Automatic Vending Machines, florists, gift and novelty, healthcare and medical supplies, household products, housewares, leisure equipment, music, newspaper and magazines, office furnishings, Food and Drug Retail Including Pharmacies, Grocery Stores, Supermarkets, Seafood Stores and Markets, Tobacco Retail., Hypermarkets and Super Centres. – Distributors including food, healthcare equipment, pharmaceuticals, technology, machinery, building products, chemicals, apparel and textiles, household durables, jewellery, leisure equipment, office furnishings and equipment, electrical equipment, media, paper and forest products, transportation equipment and supplies.

text: NIS INVESTMENTS

text:  Software Publishing and Internet Services – Internet Software and Services, Agents and Spider Software, Browser Software, Content Management Software, Tracking Software, Plug-Ins Software, Search Engine Software, Web Site Management Software, Website Infrastructure Software. Application Hosting Services, Application Service Providers (ASPs), Custom Web Site Design and Business Solutions, Online Research Services, Online Small Business Portals, Online Supply Customer Relationship Management (CRM) Software, Document Management Software, EDI, Enterprise Data Management, Enterprise Information Portals, Enterprise Middleware, Multimedia Software. Office and Home Productivity Software, Home Entertainment Software, Educational and Training Software, Entertainment Software, Computer Games, Computer Game Console Platforms. Systems Software, Automation Products and Services, Backup and Recovery Software, Computer Telephone Integration (CTI) Software, Design Automation Software, Maintenance Encryption Software, Network Administration, Operating System Software,

text:  Telecommunications – Communications Equipment, Communications Processing Equipment, Communications Towers, Telephone and Telecommunications Equipment, Telecommunications Equipment, Integrated Services Digital Network (ISDN) Equipment, Private Branch Exchange (PBX) Network Equipment, Switchboard Equipment, Telephone Switching Equipment, Telephone Equipment, Paging Systems, Teleconferencing Equipment, Wireless Telephone Equipment. Wireline Telephone Equipment, Answering Machines, Cordless Telephones – Telecommunication Services, Diversified Telecommunication Services, Alternative Carriers, Broadband Telecommunications Services, Asynchronous Transfer Mode Network Services (ATM), Digital Telecommunications Services, Digital Subscriber Line Services (DSL), Integrated Services Digital Network Services (ISDN), Point to Point Digital Telecommunications Services, Fiber Telecommunications Services, Virtual Private Network Services (VPN),

text:  Transportation – Air Freight and Logistics , Air Courier Services, National Postal Delivery Services, Airlines, Commercial Airlines, Helicopter Transportation Services, Private or Business Aircraft Services, Tankers, Marine Transportation of Passengers, Ferries, Dock and Pier Operations, Floating Dry Docks, Marinas, Marine Cargo Services, Marine Salvage, Cruise Ships. Railroad Transportation of Freight, Railroad Transportation of Passengers, Commuter Rail Systems, Trucking, Road Transportation of Freight, Road Transportation of Passengers, Carpool and Vanpool Operations, Livery Service, Limousine, Taxicab,  Utilities – Electric Utilities, Electric Power Generation by Solar, Wind, Fossil Fuels, Nuclear, and Hydro, Electric Power Distribution, Electric Power Transmission and Control, Gas Utilities, Natural Gas Transmission, Retail Energy Marketing, Independent/Merchant Power, Water Utilities, Wastewater Treatment, Water Distribution.

text: NIS INVESTMENTS B.3 SECURITY DOMAINS

text:  Identity and Access Management is the discipline that enables the right individuals to access the right resources at the right times and for the right reasons. It comprises a set of practices, processes and technology responsible for the management of digital identities and their associated access to resources. Specific IAM related activities are: user account provisioning, password management, user access administration (e.g., changes in roles, position or status (JML)), directory integration, single sign-on (SSO), Active Directory, remote access services, strong or multi factor authentication / twofactor (2FA) / three-factor (3FA), hard and soft token based authentication services, Public Key Infrastructure (PKI) and Federation type services, privileged user management (PUM), Identity and access governance (IAG) (inclusive of the processes for user access certification / re-certification, attestation, application access audits etc.), and cloud based identity services (e.g., IDaaS).

text:  Network Security comprises measures taken to protect a communication pathway from unauthorized access to, and accidental or wilful interference with, regular operations, and hence involves protecting computers and computer networks from attack and infiltration. Network security provides network protection through the restricting of network traffic, based on a set of policy defined rules. Network security provides protection at key ingress and egress points in the form of perimeters, segments and zones, typically defined and enforced by firewalls/NGFWs/firewall administration, Wireless Access Firewalls (WAF)s / RASP, Network Intrusion Detection & Prevention (NIDS and NIPS), Virtual Private Networking (VPN) concentrators, Hardware Security Modules (HSMs), Proxy Servers, Secure Email and/or Web Gateways, Unified Threat Management (UTM) appliances, Network Access Control (NAC) services, and Distributed Denial of Service (DDoS) protection and prevention services.

text:  End Point Security is a set of capabilities and services provisioned across devices and platforms to provide the required and expected level of protection against potential compromise resulting from inappropriate configuration, use or attack(s). It covers the security services, capabilities and associated management and support thereof used in the protection of all end point devices such as desktops, servers, laptops and mobile devices which users leverage to access corporate data and information. Specific examples would typically include antivirus/anti-spyware/anti-malware software on PCs

text: NIS INVESTMENTS

text: and servers, mobile device management (MDM), device encryption and management, Host Intrusion Detection & Prevention (HIPS), hardware-based protection (e.g., personal firewalls), advanced anti-malware and threat detection software and also any physical security control in place for these assets (e.g., locks.)

text:  Data Security ensures confidence in the ability of users, systems and business processes to provide the required and expected level of protection from data compromise or loss of data fidelity resulting from system compromise or failure, or inappropriate user behaviour with regard to data in whatever stage of its lifecycle. It focuses on confidentiality (to protect against unauthorized or inappropriate access), integrity (to ensure data is not improperly changed or deleted), availability (to ensure appropriate access to data for the right parties) and privacy (to assure personal information is only used for the specific business purpose for which it was collected). Typical data security protection capabilities include: data discovery & classification, encryption/decryption of data "at rest,” "in motion" or "in use" (incl. endpoint & bulk storage data encryption/decryption), digital certificate lifecycle management for digital signature based services, privacy enforcement techniques (data masking), database audit and protection (DAP) techniques, data loss prevention (DLP) services and data destruction, removal and erasure type services.

text:  Vulnerability Management is the process cycle for finding, assessing, remediating and mitigating security weaknesses. It comprises the policy and scope definition, proactive identification, remediation, mitigation and ongoing monitoring of security vulnerabilities via dedicated vulnerability assessment and management products and services. These services typically scan enterprise networks (IP ranges) and establish a baseline and trending of vulnerability status of devices, applications and databases; identify and report on the security configuration of IT assets; discover unmanaged assets; support specific compliance reporting and control frameworks; support risk assessment and remediation prioritization; and support remediation by IT operations groups which involves scanning (through resident agents on network-attached devices) of all internal and external facing target applications or devices for vulnerabilities, to determine if they are at latest available historic patch level. Service typically also includes periodic penetration testing, vulnerability assessments, asset auto discovery, generation of patch and vulnerability status compliance reports, vulnerability monitoring, and ticket raising.

text:  Security Analytics comprises the ability of the security program via technologies, processes and people to identify, define, react and remediate against potential or current or active attacks and the associated threat actors, that may result in system or service compromise, breaches or data loss events. It is essentially a set of services delivered by a Security Operations Centre (SOC) or equivalent capability consisting of a centralized focal point of security specialists where enterprise information systems (websites, applications, databases, data centres and servers, networks, desktops and other endpoints) are monitored, assessed, and defended, and action plans devised to counter any undesirable events detected. Typical security analytics services include security incident and event log collection, monitoring and management (SIEM), managed log retention & analysis, user behaviour analytics (UBA), threat intelligence services, fraud detection and response services, digital forensics and cyber incident response services.

text:  Application Security describes the use of software, hardware, staff and process methods to provide through life application protection from threats. It therefore comprises a set of measures built into the application development process to prevent the unauthorized access, theft, modification of or erasure of sensitive data through the exploitation of applications. Specific examples include: the identification of security

text: NIS INVESTMENTS

text: flaws in application design, development, deployment, upgrade, or maintenance through code assurance techniques such as black box analysis and testing, health checks, the use of static & dynamic application testing techniques (SAST/DAST/IAST) and application security frameworks, and/or via data obfuscation, filtering & masking, secure coding practices and software composition analysis (SCA) etc.

text:  Governance, Risk, and Compliance Management (GRC) in general comprises the set of practices and processes, supported by a risk-aware culture and enabling technologies, that improves decision-making and performance through an integrated view of how well an organization manages its unique set of risks.

text: – Security Governance is thus defined as a number of "cross-functional" security activities which include the development and maintenance of security policies, standards & procedures, the communication of business values, culture & principles, security strategy & organization, training & awareness, documentation & guidance, communication plans, security service metrics, audit and compliance oversight, financial management of security services, security vendor management, security PMO etc. obligations. Governance costs and staffing include the strategic leadership of security standards, policies and practices, as typically represented by the Chief IT security Officer (CISO) or equivalent, and his immediate office. – Risk Management is defined as the function dedicated to ensuring that adequate controls are designed and implemented to mitigate the various risks associated with IT assets (including data), infrastructure, and processes. It includes activities such as periodic and annual IT audits (non-regulatory), risk assessment / monitoring, issue management & action tracking, and the development and execution of remediation plans. – Compliance Management is the process of identifying, managing and reporting compliance activities related to organizational, commercial and regulatory compliance obligations. Compliance requirements can be derived from internal directives, procedures and requirements, or from external laws, regulations, standards and contractual agreements.

text: B.4 SECURITY ASSET TYPES

text:  Hardware is defined as: – All dedicated hardware assets utilized in support of the Security operations, for each category indicated (i.e., Network Security, Endpoint Security etc.). – Examples include firewalls, security gateways, security appliances, security toolset platforms and ID tokens, etc. – Include only annual asset costs that are directly or recognizably related to the defined in-scope security functions. Do not include costs of hardware assets whose prime purpose is not security. For example, there may be routers deployed that have firewall, encryption or NIPS capabilities, but you must not include any apportionment of their annual costs unless you can identify a cost to specifically enable a security function - such as a firewall "add-on" enabler cost of extra router hardware or software. – Hosting / facilities / occupancy costs for space dedicated to in-scope security hardware such as the apportioned annual costs of hosting security-related devices, storage arrays and appliances in the data center, including power/heat management and raised floor. It also includes the annual cost of any consumables related to the security activities.

text: NIS INVESTMENTS

text:  Software is defined as: – Annual license and maintenance as well as costs associated with new purchases and upgrades for all software dedicated to operating or managing the security systems applications for each category of security expenditure. – Examples include endpoint security suites, identity and access management, security information and event management, content filtering, etc. – Only software license costs that are directly or recognizably related to the defined in-scope security functions are included. Costs of software whose prime purpose is NOT security are excluded. – For example, there may be enterprise licenses for OS, productivity suite software or enterprise packages that have security capabilities (e.g., BitLocker encryption in WinOS). No apportionment of their annual costs are included unless a cost to specifically enable a security function can be identified. An example would be an "add-on" software charge for a security capability, or a specific module license charge for security functionality (e.g., Oracle Identity Manager)

text:  Outsourcing is defined as: – Outsourcing is the use of external service providers to effectively deliver ITenabled business process, application service and infrastructure solutions for business outcomes. Outsourcing, which also includes utility services, and cloudenabled outsourcing, helps clients to develop the right sourcing strategies and vision, select the right IT service providers, structure the best possible contracts, and govern deals for sustainable win-win relationships with external providers. Outsourcing can enable enterprises to reduce costs, accelerate time to market, and take advantage of external expertise, assets and/or intellectual property. This includes: – Fees for third-party or outsourcing contracts primarily comprising services for managing or monitoring security devices, systems or processes where the services are provided on-site. – Managed Service Provider (MSP)/Cloud is defined as: Remote subscription-based monitoring and/or management of security devices such as firewalls, intrusion detection and prevention functions via customer-premises-based or networkbased devices. It also includes remotely delivered specialist managed security services such as Threat Intelligence, SIEM/SOC, DDoS etc. and cloud-based security services such as IDaaS. – Consulting is defined as: Security advisory services that help organizations analyse and improve the efficacy of business operations and technologies strategies.

text:  Personnel is defined as: – Costs/FTEs include in-house and contract personnel supporting IT Operational Infrastructure Security, Vulnerability Management and Security Analytics, Application Security and Governance and Risk and Compliance Management.

text: -N -EN -028 -20 -06 TP

text: ABOUT ENIS A

text: ISBN 978-92-9204-442-8 DOI: 10.2824/50973