NIS investments : cybersecurity policy assessment : November 2023

This document is the fourth edition of the NIS investments study published by ENISA to understand the impact of the Directive on the Security of Network and Information Systems (NIS Directive)3 on Operators of Essential Services (OES) and Digital Service Providers (DSP). Specifically, the objective of this report is to support policy makers in assessing the effectiveness of the existing EU cybersecurity policy framework by providing insights into how much OESs and DSPs in cybersecurity budgets and comply with the requirements of the NIS Directive, and what impact the NIS Directive has had on these operators, as well as to collect data on various operational and organisation aspects of OESs and DSPs in the EU. The directive on measures for a high common level of cybersecurity across the Union (NIS 2 Directive) 4, which adapts the previous NIS Directive to current needs has already been adopted and the transposition process is underway. The new rules cover a wider scope compared to the previous Directive and increase the number of entities that need to take measures for the management of cybersecurity risk. However, since implementation of NIS2 is still on-going, for the purposes of this report the NIS Directive definitions and scope are taken into consideration. With 2023 being the European Year of Skills and cybersecurity skills shortage being consistently identified as a key challenge for operators in the EU, the present analysis presents data on how OES and DSPs address their cybersecurity skills needs and where the main skills gaps currently exist. This information can be used to inform follow-up actions in the context of the Cybersecurity Skills Academy presented by the European Commission5. Moreover, the present report provides a more in-depth analysis of OES in the Transport sector, examining among other topics the influence of and interplay between the NIS Directive and sectorial regulations concerning transport security and safety. To ensure a representative account of all 27 EU Member States, 40 organisations in each Member State were surveyed making a total of 1,080 organisations surveyed across the EU. Additional information on the demographics of the survey is available in Annex A. Moreover, available global benchmark data is presented to highlight the most relevant trends related to information security spending, cyber talent management and the cyber threat landscape The target audience of this report is EU and National policymakers. This series of reports has been streamlined to produce historical data sets that allow for the monitoring of how specific vital indicators, such as overall cybersecurity budgets, develop over time and how policy affects these indicators, as well as allowing the collection of valuable data or evidence to inform policy decisions as part of the activities of ENISA's Cybersecurity Policy Observatory (CSPO). This report may also provide helpful information to a secondary audience, OESs and DSPs.