The NIS2 Directive

explore the growing complexity of cyber security across people, cloud, endpoints, and devices, and highlight talent shortages, advanced threats, data deluge, and noisy alerts as core challenges.

The NIS2 directive builds on the original NES directive to strengthen EU cybersecurity, broaden scope to sectors, and require incident reporting and stricter penalties for both states and private companies.

Explore the NIS2 framework for essential and important entities, compare large, medium, and small classifications, and note that essentials face inspections and scans, while important entities trigger post-incident actions.

Identify sectors in scope under the NIS directive, such as energy and health. Classify them as essential or important for large and medium entities, with small entities out of scope.

Outline the fines and liabilities under the NIS2 directive, including personal liability for top management and penalties tied to turnover with GDPR cross-compliance and enforcement powers.

Understand the three core pillars of NIS2: member states responsibilities, risk management, and cooperation in information exchange, and how they shape EU cybersecurity compliance.

Member states implement eu law through national authorities and strategies, establish cbd frameworks for vulnerability and threat sharing, and develop crisis management frameworks for business continuity and incident response.

Advance the NIS2 directive's cooperation and information exchange pillar by establishing a csirt network, coordinated vulnerability disclosure process, and european vulnerability registry for streamlined incident response and threat intelligence.

Apply the NIST definition: a threat is any circumstance that could harm operations or assets through an information system, via unauthorized access, destruction, disclosure, modification, or denial of service.

Explore how intelligence, threat intelligence, and cyber threat intelligence relate, and why only cyber threat intelligence focuses on adversaries' TTPs in cyber security.

Define cyber threat intelligence as knowledge about adversaries' motivations, intentions, and methods, including tactics, techniques, and procedures (TTPs), collected, analyzed, and disseminated to enable threat informed defense.

Define threat, vulnerability, and risk, and show how a threat actor exploits a vulnerability to cause downtime, confidentiality breaches, or integrity violations, creating risk.

Explain how threat informed defense guides cyber intelligence to identify your mission, target threat actors, their motivations, and the TTPS they use, then protect against them.

Define tactics as high-level threat actor objectives, techniques as how to realize them, and procedures (sub techniques) as the detailed steps and technology, such as vulnerability scanning.

Compare indicators of compromise with indicators of attack, where iocs signal breach evidence like file hashes and domains, while ioas reveal threat actor intent and behavior.

For the nis2 directive course, discover the pyramid of pain and learn why detecting tactics, techniques, and procedures offers tougher defense than chasing hash values, ip addresses, domains, or tools.

Explore CTI sources across three areas: enterprise tools (paid), osint (free offerings), and social media, with examples like Microsoft Defender Threat Intelligence, VirusTotal, Shodan, and Twitter insights.

Assess how risk management enforces top management accountability, builds a cybersecurity program, implements incident handling, business continuity, supply chain security, secure software development lifecycle, cyber hygiene, and cryptography per NIST.

Identify, document, and manage critical risks by recognizing threats, vulnerabilities, and assets; prioritize and evaluate them, then align risk management with asset management best practices and develop actionable mitigation plans.

Corporate governance defines the system of rules and practices that direct a firm, including cybersecurity and generative AI. Enterprise risk management makes risks transparent for risk-aware, financially informed decisions.

Explore enterprise risk management as the engine of corporate governance by identifying, analyzing, prioritizing, responding, and monitoring risks across financial, environmental, and cyber domains.

Cybersecurity risk management aligns with enterprise risk management to protect confidentiality, integrity, and availability by assessing threats, vulnerabilities, and impacts, and choosing mitigation, remediation, avoidance, transfer, or acceptance.

Outline a practical CSRM implementation plan aligned with NIST, starting with inventory of assets, systems, and processes to establish a risk baseline, centralize risks, and prioritize with a heat map.

The lecture outlines NIS2 incident handling and reporting requirements, including prompt detection, incident response, 24-hour early warnings, 72-hour notifications with IOCs and impact, and a final report within a month.

Explore the four-step NIST incident response process, from preparation to post-incident activity, and learn to detect, analyze, contain, eradicate, recover, and apply lessons learned.

Develop tailored incident response policies, train staff and security teams, allocate tooling and hardware, and establish a pre-incident communication plan, then run regular tabletop exercises to learn and improve.

Leverage detection tools and monitoring to identify security incidents early, apply a structured analysis (log analysis, forensics, root cause analysis) to determine scope and impact, and document with playbooks.

Master short-term and long-term containment strategies to limit incident spread, automatically react to ransomware, eradicate malware and unauthorized access, and recover with validated integrity, backups, and post-recovery monitoring.

Conduct post incident activity to capture lessons learned, update the incident response plan, report to stakeholders, and review metrics like mean time to respond to drive continual improvement.

Implement a robust incident response policy with defined roles and escalation, and deploy a centralized detection framework using automated monitoring, IDS, and log analysis, aligned with NIST guidance.

Establish a documented business continuity plan and clearly defined crisis management procedures, reinforced by drills to validate effectiveness, prioritize critical systems for rapid recovery, and ensure timely communication with stakeholders.

Identify systems and processes through a business impact analysis to prioritize disruptions. Develop a tailored continuity plan with crisis procedures, recovery time objectives, recovery point objectives, and redundancy for resilience.

Explore the NIS2 supply chain security requirements, defining and documenting critical services, recognizing and monitoring service suppliers, and maintaining cybersecurity control over maintenance and IT contracts.

Identify and populate a centralized supplier register with critical services, inventory and assess risk, implement monitoring and access controls, and enforce security-focused contracts with onboarding, offboarding, and regular reviews.

Integrate security into the system development lifecycle, including design, implementation, and testing, run penetration testing on critical systems, and establish vulnerability management with periodic assessments to address emerging threats.

Understand vulnerabilities as weaknesses in information systems, security procedures, internal controls, or implementation that a threat source could exploit, including software, humans, hardware, and physical security; CVEs cover a subset.

Explore the common vulnerabilities and exposures (CVE) framework, how CVE IDs follow the CVE-YYYY-ID format with descriptions and vendor data, and how CVSS scores prioritize threats, illustrated by Chrome vulnerability.

Understand the CVSS, the common vulnerability scoring system, and how its 0–10 scale, v2 vs v3, and the none and critical severities, plus asset criticality, influence prioritization.

Learn the vulnerability management process from identification to remediation and reporting, including detection through automated scans or manual testing, evaluation with CVSS, and prioritization and compensating controls.

Identify vulnerabilities using scanning tools, compare agent-based and agentless options, weigh visibility versus performance, supplement with manual testing, and maintain an up-to-date asset inventory to scope scans.

Assess vulnerability impact by weighing severity, asset criticality, and context such as internet exposure and interfaces to critical assets, while using CVSS alongside ongoing vulnerability research and advisories.

Prioritize vulnerabilities using a risk-based ranking that weighs CVSS scores, ASIL criticality, compliance requirements, resource availability, and operational impact to avoid production disruption.

Identify and apply remediation options for vulnerabilities by patching, adjusting configurations, or implementing compensating controls, tailored to vulnerability type and environment such as OT or cloud.

Document vulnerabilities—identified, mitigated, and outstanding—and conduct regular stakeholder reviews; prepare audit-ready reports to ensure regulatory compliance and reduce attack surface.

Simulate a penetration test as a cyber attack that identifies vulnerabilities before real attackers exploit them, using techniques and the Mitre attack and Mitre Atlas frameworks under controlled, documented scope.

penetration testing detects security weaknesses and provides remediation guidance, delivering real-world insights to strengthen risk management and compliance, validate controls, and boost organizational resilience through simulated attacks beyond automated scans.

Understand how red teaming provides a continuous, end-to-end security assessment using adversary tactics, techniques, and procedures, unlike penetration testing’s time-bound, vulnerability-focused scope and outcomes.

learn to embed security across the system development life cycle with secure coding, threat modeling, vulnerability management, and regular penetration testing, while monitoring configurations and third-party dependencies.

Identify and document key data and assets, map dependencies, and document critical systems to strengthen cyber hygiene; implement onboarding and awareness training with clear processes for information security risks.

Identify and document key data and support assets, map critical systems and dependencies, and implement onboarding and ongoing training with metrics to assess cyber hygiene and awareness.