NIS2, DORA and the significant role of encrypted storage – Expert insights

Incident reporting and international data transfer

Both NIS2 and DORA require detailed incident reporting to the relevant regulatory bodies. Clarke notes that DORA specifies a 72-hour reporting window, with clear guidelines on what information must be included, like the number of customers affected and the nature of the risks.

Regarding international data transfers, Clarke emphasises the need for secure practices. DORA, for instance, requires businesses to test their business continuity plans and provide evidence of their effectiveness. This ensures that companies can handle incidents and demonstrate their preparedness.

Turning compliance into a business opportunity

Clarke believes that regulatory compliance can be a significant business opportunity. Demonstrating alignment with cybersecurity and data protection standards can open doors to government contracts and partnerships with larger companies. These entities often require smaller companies to provide evidence of their cybersecurity measures to mitigate liability risks.

The advantages of hardware-based encryption

To comply with NIS2 and DORA, USB drives must have robust security features. Clarke points out the importance of hardware-based encryption, which offers several advantages over software-based solutions. Hardware-based encryption is a closed ecosystem that provides strong security and protections against attackers.

Software encryption on mobile storage – on the other hand – can be easily removed through reformatting, compromising compliance and increasing the risk of data breaches. Additionally, password-protected and software-encrypted files can be hacked using easily accessible password-guessing tools available online.

When asked if organisations should look towards NIST’s FIPS certification, as the “gold standard”. “Absolutely.” Clarke asserts “There's been quite a few cases where people have claimed they've got better security and encryption and it hasn't fulfilled, it's been broken”.

Kingston IronKey D500S and Keypad 200 drives offer FIPS 140-3 Level 3 (pending) certification, so that organisations can be confident that sensitive data is protected, with one of the strongest military-grade encryption protection on the market today. For high-capacity storage, the FIPS 197-certified IronKey Vault Privacy 80 external SSD drives scale up to 8TB, allowing air-gapped backups of critical data.

Conclusion

Cybersecurity threats continue to intensify and spread, and this is why directives and regulations like NIS2 and DORA play a key role in ensuring the resilience of critical infrastructure and financial institutions. Clarke’s insights underscore the importance of compliance, effective incident reporting, robust security measures, and utilising hardware-encrypted storage. By embracing these regulations, organisations can not only enhance their security posture but also gain an edge by leveraging compliance as a competitive advantage.

Watch video