Navigating the NIS2 Directive: A Call to Action for African Companies Trading with the EU

As the European Union (EU) implements its new NIS2 cybersecurity directive, African companies engaged in trade with EU member states face a landscape marked by significant regulatory changes. This directive, which aims to bolster cybersecurity across various sectors, presents both challenges and opportunities for businesses in Africa. Leading cybersecurity provider Check Point Software Technologies emphasizes the importance of understanding and complying with these new regulations to protect operations and maintain vital trade relationships.

Understanding the NIS2 Directive

The NIS2 Directive builds upon the original NIS1 directive established in 2016, expanding its scope to cover a broader range of sectors, including Energy, Banking, Transport, Digital Infrastructure, Healthcare, Food Production, and Research. With over 80% of European enterprises now falling under its jurisdiction, the directive extends its reach to global supply chain partners, many of which are based in Africa. This means that African companies must now navigate a complex regulatory environment that demands heightened cybersecurity measures.

Collins Emadau, Check Point Partner and Director at Westcon, highlights the urgency of this situation: "Africa’s economic future hinges on its relationship with Europe. Businesses, particularly in South Africa, Kenya, and Nigeria, must grasp the significant implications of NIS2. Non-compliance could lead to substantial fines and jeopardize critical trade relationships with EU member states."

The Economic Impact of NIS2 Compliance

The EU stands as Africa’s largest trading partner, with trade agreements worth billions of dollars annually. For African businesses, particularly those in sectors integral to the EU’s supply chains, compliance with NIS2 is not just a regulatory requirement but a necessity for sustaining trade partnerships. The directive’s stringent cybersecurity measures are designed to protect critical infrastructure and ensure the integrity of global supply chains.

Issam El Haddioui, Head of Security Sales Engineering for Africa at Check Point, emphasizes the importance of immediate action: "NIS2 sets a new benchmark for cybersecurity. African businesses need to take action immediately. Awareness of these requirements is critical—not just for maintaining EU partnerships but for bolstering the overall resilience of African economies against cyber threats."

The Current Cybersecurity Landscape in Africa

The cybersecurity landscape in Africa presents a stark contrast to global standards. According to Interpol’s 2021 Africa Cyberthreat Assessment Report, African organizations invest an average of only 0.05% of their revenue on cybersecurity, significantly lower than the global average of 0.3-0.5%. The financial impact of cybercrime in Africa is estimated at over $4 billion USD, equivalent to about 10% of the continent’s GDP. By improving their cybersecurity posture, African businesses can align with international standards and protect their data and reputations.

Increased Accountability for Business Executives

One of the most significant changes introduced by NIS2 is the personal liability it places on business executives in the event of a cyber incident. This regulation allows for financial accountability in cases of breaches, with fines reaching up to EUR 7 million or 1.4% of a company’s global annual turnover—whichever is higher. This requirement underscores the critical role of corporate leadership in ensuring robust cybersecurity practices.

Steps for Compliance: A Roadmap for African Businesses

To navigate the complexities of NIS2 compliance, Check Point recommends that African businesses take the following four key actions:

1. Knowledge: Business leaders should gain a fundamental understanding of cybersecurity to effectively communicate with IT teams and facilitate informed decision-making.

2. People: Establish a nimble IT security department by appointing key roles such as a Data Protection Officer (DPO) and a Chief Information Security Officer (CISO) to distribute responsibilities effectively.

3. Audit: Conduct regular risk assessments and audits to identify and mitigate vulnerabilities, ensuring continuous monitoring to stay compliant with evolving threats.

4. Incident Management: Develop clear protocols for responding to cyber incidents, including rapid reporting to national authorities and stakeholders.

A Long-Term Commitment to Cybersecurity

Compliance with NIS2 is not merely a checkbox exercise; it necessitates a sustained commitment to cybersecurity. Starting in 2028, organizations will be required to annually document their NIS2-compliant IT infrastructure, demonstrating alignment with the latest technological advancements.

El Haddioui further asserts, "Economic leaders in Africa, such as South Africa, Kenya, and Nigeria, should consider adopting the NIS2 framework to strengthen their national cybersecurity regulations. By enhancing cyber-readiness, African businesses can meet international standards and protect their data and operations against evolving threats."

Conclusion: Cybersecurity as a Matter of Survival

The NIS2 directive signifies a critical shift in the cybersecurity landscape, and African business leaders must recognize that cybersecurity is now a matter of survival rather than mere compliance. Proactive measures can safeguard their futures, avoid hefty penalties, and ensure their organizations thrive in an increasingly interconnected global economy. By embracing the challenges posed by NIS2, African companies can not only protect their interests but also contribute to a more secure and resilient global trade environment.