NIS2 and the UK: Why It Still Matters for Cybersecurity & GRC
News and information from the Advent IM team.
- by Anthony Orjally
- Advent IM Blog
The NIS2 Directive is the EU’s latest and most comprehensive effort to enhance cybersecurity across critical sectors. But with the UK no longer an EU member state, many businesses might assume that NIS2 is irrelevant to them. The reality, however, is very different.
Despite Brexit, NIS2 has far-reaching implications for UK organisations, particularly those operating in international markets, providing essential services, or working within the global supply chain.
Why Should UK Businesses Pay Attention to NIS2?
Even though the UK is not obligated to implement NIS2, there are several key reasons why it still affects UK organisations:
✅ EU-Based Operations & Customers – If your business provides essential or important services within the EU, you may still need to comply with NIS2 regulations.
✅ Supply Chain Dependencies – Many UK companies supply services or technology to EU-based businesses subject to NIS2. Compliance may become a contractual requirement.
✅ Regulatory Alignment – The UK is expected to update its NIS Regulations to align with some of NIS2’s key provisions, particularly in areas like supply chain security and incident reporting.
With cyber threats evolving rapidly, businesses that proactively align with international best practices will be better positioned to mitigate risk, maintain regulatory compliance, and protect their reputation.
How NIS2 Will Influence UK Cybersecurity & GRC
- Expanded Scope: More Businesses Are Affected
Under NIS2, the list of regulated industries has grown. It now includes:
- Digital infrastructure & cloud computing
- Public administration
- Health & pharmaceuticals
- Transport & energy
- Financial services
- Food production
- Space & satellite operations
This means that UK businesses providing services to these industries within the EU may need to comply. Additionally, the UK government is expected to update the UK NIS Regulations to cover more sectors and suppliers, even if they operate purely within the UK.
- Stronger Governance & Accountability
NIS2 significantly increases corporate responsibility for cybersecurity. Senior leadership can now be held personally liable for failing to ensure compliance with security requirements.
The UK has already been moving in a similar direction, with regulators like the Financial Conduct Authority (FCA) and Information Commissioner’s Office (ICO) holding senior executives responsible for cybersecurity failings. As cyber risks become a boardroom issue, UK companies should ensure that GRC frameworks incorporate executive accountability for cyber risk.
- Tougher Supply Chain Security Rules
One of the most significant aspects of NIS2 is the requirement for businesses to assess and mitigate supply chain risks.
- Third-party providers must now meet stringent security requirements.
- Businesses must conduct risk assessments on their vendors and suppliers.
- Non-compliance within a supply chain could result in penalties or contract terminations.
With supply chain cyberattacks on the rise, UK businesses should expect increased pressure from customers and partners to demonstrate robust security measures. Implementing third-party risk management (TPRM) policies within a Governance, Risk, and Compliance (GRC) framework will be critical.
- Stricter Reporting Requirements & Heavy Fines
NIS2 introduces tighter breach reporting obligations, requiring organisations to notify regulators of cyber incidents within 24 hours.
Fines for non-compliance can be severe:
- Up to €10 million or 2% of global annual turnover for major firms.
- Up to €7 million or 1.4% of global turnover for smaller entities.
While these penalties apply within the EU, UK businesses working with EU partners may also face compliance pressure. Additionally, the UK may strengthen its own enforcement mechanisms to align with these global standards.
What Should UK Businesses Do Now?
Even if NIS2 is an EU regulation, its global impact means that UK organisations cannot afford to ignore it. Proactive steps include:
✅ 1. Strengthen Cyber GRC Frameworks
Implement a risk-based approach to cybersecurity governance, ensuring compliance with:
- UK NIS Regulations
- GDPR
- ISO 27001 (for information security management)
- Cyber Essentials Plus (for UK government contracts)
🔍 2. Assess & Secure Your Supply Chain
- Conduct risk assessments on suppliers and third-party service providers.
- Implement contractual security requirements to align with NIS2 and UK NIS updates.
- Regularly audit vendors’ cybersecurity measures.
🛡 3. Adopt a Resilience Mindset
Cybersecurity regulations will continue evolving. Businesses should integrate security into their operational culture, rather than treating compliance as a tick-box exercise.
Regular Red Team testing, cyber risk assessments, and security training should be part of an ongoing GRC programme to future-proof organisations against both regulatory changes and emerging cyber threats.
Final Thoughts: Why NIS2 Still Matters for the UK
While the UK isn’t legally bound by NIS2, its influence on global cybersecurity standards is undeniable.
Ignoring it could mean:
🚨 Losing business with EU-based customers and partners.
🚨 Failing to meet evolving UK regulatory expectations.
🚨 Exposing your organisation to security risks that regulators are actively working to mitigate.
By integrating robust GRC frameworks that align with international best practices, UK businesses can stay ahead of the curve, ensuring compliance, security resilience, and continued business success.
Is your organisation ready for the ripple effects of NIS2? Let’s discuss
From Ellie Hurst ASyI – Advent IM Director