Cybersecurity: uniform standards are key to security

Cyberattacks are on the rise, geopolitical tensions are escalating, and digital infrastructures are increasingly becoming the backbone of modern economies. At the same time, the requirements for securing them are growing. With NIS2, the Critical Entities Resilience Directive (CER) and the Cyber Resilience Act (CRA), the European Union is tightening the requirements for operators of critical infrastructure – with far-reaching consequences for businesses across all sectors. Tobias Mielke, an expert in information security, cybersecurity and certification at TÜV NORD, puts the current developments into perspective.

“The days when cyber security could be regarded as a peripheral technical issue are over,” sums up Tobias Mielke. Recently, there has been an increasing frequency of physical and cyber attacks on critical infrastructure facilities. This shows that the question of potential over-regulation must not be viewed in isolation from the actual threat landscape. However, the implementation of the new regulations involves considerable effort: according to the German government’s regulatory impact assessment, the implementation of NIS2 alone is likely to cost affected companies in Germany around 2.3 billion euros annually; on top of this come one-off expenses of approximately 2.2 billion euros for new processes, risk management and technical measures.”

Mielke regards the multitude of different European regulatory frameworks and their sometimes divergent requirements as one of the greatest challenges. Companies must fulfil reporting obligations, prepare for audits, document supply chains and, where necessary, provide certifications or evidence of compliance. Smaller organisations in particular quickly reach their limits in terms of staff and finances. “It is not the security requirements themselves that are the problem, but rather the differences in how they are structured and implemented,” says Mielke. Uniform, practical standards are therefore key to making security measurable and actionable. Cybersecurity should always be based on verifiable and measurable technological facts – not on subjective assessments or geopolitical considerations.

Security, innovation and competition – no contradiction

A frequently discussed issue is whether increased security requirements stifle innovation and competition. Mielke sees no fundamental contradiction here: “Security must be factored in from the outset – it is not a cost burden, but an investment in the future viability and resilience of businesses.” It is crucial that regulations are designed to be coherent and workable. Divergent national requirements, on the other hand, complicate implementation and lead to unnecessary additional costs.

For Mielke, security means more than just cyber security. Companies operating critical infrastructure must regularly test their processes and practise procedures so that they can react quickly in an emergency. “What matters is how quickly we can get back up and running after an outage,” emphasises Mielke. Resilience – that is, the ability to withstand disruptions and swiftly restore operations following an incident – is therefore becoming increasingly important. Security strategies must not be left gathering dust in a drawer, but must be put into practice in day-to-day operations and reviewed regularly.

Balancing security, innovation and competitiveness

According to Mielke, the real challenge lies in implementing existing regulations in such a way that they enhance security without stifling innovation or creating new dependencies. Uniform standards and practical implementation are key factors for success in this regard. Given the implementation costs running into the billions, it is precisely this balance that will determine whether the new EU requirements are perceived in the long term as a cost driver or as an investment in Europe’s digital sovereignty.