Cybersecurity Act and Regulation (2024)

Comprehensive framework aligning with NIS2, mandating risk-based cybersecurity measures for critical entities. Sets compliance deadlines by February 2025 with significant penalties up to 2% of global turnover for non-compliance.

JurisdictionCroatia
CategoryCybersecurity
StatusActive
Latest development

Analysis

Key Requirements

The Cybersecurity Act and Regulation (2024) introduces several key requirements for critical entities:

  • Risk Assessment and Management: Organizations must conduct regular cybersecurity risk assessments and implement appropriate risk management measures. This aligns with the NIS2 Directive requirements for continuous risk analysis.
  • Multi-Factor Authentication (MFA): Implementation of MFA is mandatory for all critical systems and user accounts, similar to requirements in the NYDFS Cybersecurity Regulation.
  • Supply Chain Security: Organizations must ensure the security of their supply chain, including third-party vendors, as specified in the EU Cybersecurity Act.
  • Cybersecurity Training: Regular cybersecurity awareness training for all employees is required, in line with NIST SP 800-50 guidelines.

Compliance Challenges

Organizations face several challenges in complying with the Cybersecurity Act and Regulation (2024):

  • Resource Constraints: Many organizations struggle with allocating sufficient resources for comprehensive cybersecurity measures. A Deloitte cybersecurity report found that 30% of companies cite budget constraints as a major obstacle.
  • Technical Complexity: Implementing advanced security measures like encryption and MFA across all systems can be technically challenging. The IBM Cost of a Data Breach Report highlights that complexity of security systems is a key factor in breach costs.
  • Supply Chain Management: Ensuring the security of third-party vendors is often difficult. A Ponemon Institute study revealed that 53% of organizations have experienced a data breach caused by a third party.
  • Keeping Pace with Evolving Threats: Cybersecurity threats evolve rapidly, making it challenging to maintain up-to-date defenses. The World Economic Forum Global Risks Report emphasizes the increasing sophistication of cyber attacks.

Implementation Best Practices

To effectively implement the Cybersecurity Act and Regulation (2024) requirements:

  • Adopt a Risk-Based Approach: Prioritize security measures based on risk assessments. The NIST Cybersecurity Framework provides a comprehensive guide for risk-based cybersecurity implementation.
  • Implement Zero Trust Architecture: Adopt a zero trust model to enhance security across all systems. CISA's Zero Trust Maturity Model offers guidance on implementation.
  • Automate Security Processes: Utilize automation tools for continuous monitoring and incident response. The MITRE ATT&CK framework can help in identifying areas for automation.
  • Establish a Robust Incident Response Plan: Develop and regularly test an incident response plan. NIST SP 800-61 provides comprehensive guidelines for computer security incident handling.
  • Conduct Regular Security Audits: Perform frequent internal and external security audits. Tools like OpenVAS can assist in vulnerability assessments.

Recent Updates

The Cybersecurity Act and Regulation (2024) has seen recent updates:

  • Extended Compliance Deadline: The compliance deadline has been extended to February 2025 from the original October 2024 date. This was announced in the Official Journal of the European Union.
  • Expanded Scope: The regulation now includes additional sectors such as digital infrastructure and space. This expansion is outlined in the updated NIS2 Directive.

Related Regulations

The Cybersecurity Act and Regulation (2024) interacts with several other regulations:

  • GDPR: There is significant overlap in data protection requirements. The GDPR official website provides details on how these regulations complement each other.
  • EU Cybersecurity Act: This regulation builds upon the EU Cybersecurity Act, extending its scope and requirements.
  • NIST Cybersecurity Framework: While not a regulation, this framework aligns closely with the Act's requirements. The NIST website offers comprehensive guidance.

Industry Impact

The Cybersecurity Act and Regulation (2024) has significant industry impacts:

  • Increased Cybersecurity Spending: A Gartner forecast predicts a 12% increase in global cybersecurity spending in 2025 due to regulatory pressures.
  • Shift in Security Strategies: Industries are moving towards more proactive security measures. The Cybersecurity Ventures Market Report highlights this trend across various sectors.
  • Supply Chain Restructuring: Many companies are reevaluating their supply chains to ensure compliance. A McKinsey study discusses the implications for global supply chains.

Sources

Recent developments

  • — The Commission presented an action plan supporting the safe and responsible use of AI while also strengthening Europe’s cybersecurity posture. This suggests growing policy linkage between AI governance and cyber-risk management. [4] (source)
  • — The European Commission proposed a new cybersecurity package to strengthen EU resilience and simplify compliance, including amendments to NIS2. It also aims to streamline ransomware data collection and strengthen ENISA’s coordinating role. [4] (source)
  • — The Cyber Solidarity Act entered into force to improve preparedness, detection, and response to cybersecurity incidents across the EU. The measure expands the EU’s incident-response and solidarity framework. [4] (source)
  • — The EU adopted a targeted amendment to the Cybersecurity Act extending certification scope to managed security services. This is a notable policy update for cybersecurity providers operating in the EU. [4] (source)
  • — The Cyber Resilience Act entered into force, creating mandatory cybersecurity requirements for products with digital elements. Manufacturers and retailers now face lifecycle security obligations and must prepare for CE-marked compliant products by 2027. [7] (source)
  • — EU implementing rules for NIS2 took effect as the transposition deadline arrived, tightening incident reporting and risk-management requirements for critical digital service providers. The rules specifically cover cloud, data center, platform, DNS, and managed security services. [5] (source)
  • — The World Economic Forum reported that 2024 brought major cybersecurity regulatory changes globally, including NIS2 enforcement in the EU and the Cyber Resilience Act going into force. The piece highlights a broad industry shift toward lifecycle security and stronger compliance duties. [3] (source)
  • — Malaysia’s Cyber Security Act 2024 and linked regulations took effect, including rules on incident notification, risk assessment/audit timing, licensing of cybersecurity service providers, and offence compounding. The government said the law strengthens national cybersecurity governance and oversight of critical information infrastructure. [6] (source)
  • — Malaysia published the associated regulations in the Gazette before the Cyber Security Act 2024 came into force. These regulations clarified reporting timelines and licensing requirements for cybersecurity service providers. [6] (source)
  • — A mid-2024 industry roundup noted that the SEC had already issued cybersecurity incident disclosure rules and additional guidance in June 2024. It also highlighted the EU’s NIS2 deadline and the then-new Cyber Resilience Act as major compliance drivers for companies. [2] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates