European Union’s Tough New Cyber Security Law Extends Reach to African Continent
In a significant development that will have far-reaching implications for African businesses, the European Union (EU) has officially enforced the Network and Information Security 2 (NIS2) Directive. This stringent new cyber security regulation, similar to the well-known General Data Protection Regulation (GDPR), requires all EU member states and their global trading partners to comply.
The NIS2 Directive, which builds upon the original NIS Directive introduced in 2016, imposes strict cyber security requirements, including enhanced management liability, reporting to authorities, risk management, and business continuity planning. It came into force on 16 January 2023, and EU member states had until 17 October 2024, to transpose it into national law.
African Businesses in the Crosshairs
The NIS2 Directive has particular relevance for African businesses, as the EU remains the continent’s largest trading partner. With over 18 economic partnership agreements and trade worth billions annually, African businesses, especially in sectors like energy, banking, transport, and manufacturing, are key partners in EU supply chains.
More than 80% of European enterprises are now within the scope of the NIS2 legislation, and it extends to global supply chain partners. To continue doing business with EU companies, African organisations must comply with NIS2, which mandates strict cyber security measures to protect critical infrastructure and supply chains.
The Cost of Non-Compliance
Failure to comply with NIS2 can result in hefty fines of up to €7 million or 1.4% of a company’s global annual turnover, whichever is higher. Additionally, personal liability has been introduced, meaning that business leaders can be held financially accountable for cyber attacks. This goes beyond the GDPR, placing even more responsibility on corporate leadership to ensure robust cybersecurity practices are in place.
The Road to Compliance
To ensure compliance with NIS2, African businesses must implement a comprehensive incident response plan, conduct regular cybersecurity training for both IT and leadership teams, and document their NIS2-compliant IT infrastructure annually.
A Call to Action
“African countries, especially economic leaders like South Africa, Kenya, and Nigeria, should consider using the NIS2 framework as a model for strengthening their own national cyber security regulations,” says Issam El Haddioui, head of security sales engineering for Africa at Check Point. “By improving cyber-readiness, African businesses can not only comply with international standards but also protect their data, operations, and reputations from evolving threats.”
The NIS2 Directive represents a significant milestone in the global effort to combat cyber threats. African businesses that fail to adapt to this new reality risk facing severe consequences, both financial and reputational. By proactively addressing their cyber security needs, African organisations can not only protect themselves from the growing threat of cyber attacks but also secure their place in the global marketplace.
