From: HomelandSecurityToday.US
By: Michael Assante and Doug Wylie
In August 2014, France’s Network & Information Security Agency (ANSSI) publically unveiled plans to “make its critical infrastructure more resilient to cyber attacks.” The rules and guidelines established by ANSSI impact France’s entire critical infrastructure supply chain, including control system asset owners, operators and IT administrators, system integrators, service providers and product manufacturers. While these regulations were announced with minimal fanfare, ANSSI formulated what would become the European Union’s (EU) first mandatory critical infrastructure cybersecurity installation and maintenance requirements.
Nearly one year later, the German Parliament followed suit, passing regulations intended to hold the owners and operators of critical infrastructure accountable for maintaining strict cybersecurity standards. However, this regulation diverges from French law, adding provisions that mandate penalties up to €100,000 ($114,000) for noncompliance. As a result of the legislation, more than 2,000 German organizations were given a two-year grace period to comply with the complex certification requirements. Each organization must now also obtain clearance from the country’s Federal Office of Information Security. The cascading effects of the regulation will also impact non-German organizations within the supply chain.
Leave a Reply