Guest post by Ferenc Német; qualified cyber security consultant
The impact of NIS 2 on suppliers and the business value of cyber security in the SME sector
Following a cyberattack, the losses incurred by an SME rarely amount to nothing more than the cost of IT repairs on the invoice. A stolen customer list can trigger a crisis of confidence; a crashed order system can lead to a loss of turnover; and compromised supplier access can result in the loss of a contract. NIS 2 is therefore a business issue even for those smaller companies that are not directly subject to the requirements of the Hungarian Cybersecurity Act.
There are various forms of information loss
Data confidentiality is compromised when unauthorised parties gain access to customer data, quotation prices, manufacturing plans or access keys. Integrity is compromised when, for example, a bank account number is altered on an invoice without being noticed, or when manufacturing parameters are modified. A lack of availability, meanwhile, means that staff cannot access orders, stock or invoicing systems. A single attack can affect all three areas simultaneously.
Lost data can be partially recovered from backups, but business secrets that have already been leaked cannot be ‘taken back’. Recovery may therefore require a forensic investigation, customer notification, password changes, contractual negotiations and prolonged monitoring. In the event of a personal data breach, the GDPR’s notification and information requirements may apply independently of NIS 2. SMEs must know exactly which data is critical, where copies of it are located, and how long it will take to restore operations.
The cost to reputation and customer trust
Customers rarely see the technical details. What they do notice is that they are not receiving the product on time, that the fate of their data is uncertain, or that a fraudster is asking them to make a bank transfer in the supplier’s name. In such cases, the quality of the initial communication matters: when did we detect the problem, what is still functioning, what data might be affected, and when will we provide further updates? Remaining silent may seem convenient in the short term, but subsequent, contradictory statements can exacerbate the loss of trust.
The 2022 incident involving the developer of the Hungarian KRÉTA system clearly illustrates the risk posed by suppliers. The NAIH imposed a data protection fine of 110 million forints on Educational Development Informatikai Zrt., formerly eKRÉTA Informatikai Zrt. According to the authority, data security settings in the development environment were inadequate, and the data processor failed to notify the schools concerned, as data controllers, without undue delay. The attack began with a phishing attempt; the decision did not establish as a proven fact that the entire live system had been compromised.
The fine was imposed under the GDPR, not under NIS 2. The lesson for SMEs is clear: they must prepare for staff negligence by combining technical safeguards with organisational preparedness, and arrangements for notifying partners must be established in advance.
The chain reaction of economic loss
Let us suppose that a component manufacturer with 25 employees is unable to accept orders for three days and takes a week to restore production data. The direct costs are the expert, the new equipment and overtime. The less obvious losses include the idle production line, late delivery penalties, emergency transport, postponed new orders and more extensive checks by partners. This is an illustrative scenario, not an actual event or a general cost estimate. It is worth calculating the figures for your own company: daily loss of revenue × expected downtime + recovery costs + contractual and data protection costs.
NIS 2 imposes risk management and incident reporting obligations directly on essential and important organisations. The Hungarian classification depends on activity, size and specific exemptions; therefore, even a medium-sized enterprise should not automatically consider itself exempt. However, even small suppliers who are not subject to these obligations may face requirements set out in their contracts: secure remote access, incident notification deadlines, monitoring of subcontractors, backup testing and revocation of access rights. A large client is managing the risk within its own supply chain when it makes such requests.
It is therefore advisable to specify in the contract with the client exactly what data and systems the supplier has access to, within how many hours they must report a suspicious incident, what information must be included in the initial notification, and who bears the costs of the investigation. A general promise that ‘we will take all necessary security measures’ offers little guidance in the event of a dispute. Conversely, an overly strict, unachievable commitment creates a separate contractual risk. SMEs should commit to realistic deadlines and verifiable controls, and then record the dates and results of the tests carried out.
Why demonstrable security is a competitive advantage
It is easier for the contracting authority to select a company that provides a concise, verifiable set of answers: what data it has access to, who is responsible for incident management, when it reports a problem, when it last tested the recovery process, and who is granted remote access. This does not guarantee a contract, and different clients may request different checks. However, it reduces the time taken for due diligence and lends greater credibility to the promise of delivery security. Good security can also improve a smaller company’s negotiating position when the client demands strict contractual commitments.
Non-compliance with NIS2 is comparable to non-compliance with HACCP and ISO quality management systems. HACCP identifies food safety hazards and sets out control points, monitoring and corrective actions. In ISO quality assurance, documented processes, accountability and continuous improvement help to ensure consistent quality. In cybersecurity, the same approach can be applied to key systems, access controls, backups and incident management: assessment, control, evidence, testing, correction. The analogy does not imply equivalence: neither HACCP nor ISO certification alone proves compliance with NIS 2. (ISO/IEC 27001 may be relevant specifically as an information security framework, if justified by the size of the organisation and customer requirements).
In practice, a simple ‘cyber control point’ could be the account used to access the supplier portal. Who can request access, who approves it, is there multi-factor authentication, when do we revoke access, and what log records the logins? The same cycle applies to backups: are backups taken, are they stored separately from the live network, and can we restore a complete order from them? The value of the system is evident from regular testing and the rectification of errors; just as, in quality management, a completed template is not enough.
System Administrator and Information Security Officer
The system administrator manages the technical environment: they set up accounts and permissions in accordance with approved rules, carry out updates, create backups, monitor logs and resolve faults. The person responsible for cyber security – that is, the security of electronic information systems (often referred to as the ISO in practice) – coordinates risk assessment, the development of security requirements and policies, the monitoring of controls, training and incident preparedness; the precise statutory duties depend on the organisation’s classification. Management approves the rules and provides resources, whilst HR and process owners implement the human aspects: onboarding and offboarding, role changes, training, cover arrangements, reporting phishing attempts, and the early reporting of errors without repercussions. The system administrator can technically deactivate an account, but regulating employee behaviour and human workflows is not, in itself, part of their operational remit. In a small company, these two roles can be combined, provided that responsibilities, decision-making powers and oversight are clearly defined.
Five steps to get an SME started
- Firstly, list the revenue-generating processes and the data, systems and external service providers required for them.
- Secondly, enable multi-factor authentication for email and remote access; do away with shared accounts.
- Thirdly, create a separate backup and actually carry out a test restore from it.
- Fourthly, establish a one-page incident response procedure: who makes the decisions, who we contact, and when we notify the client and the authorities, if necessary.
- Fifthly, ask your key clients what evidence they expect from suppliers. Base the budget on these specific risks.
What to do on the first day
If the company sees a blackmail message or receives an unusual payment request, the first step is to stop it from spreading further: disconnect the affected device from the network, suspend any suspicious access, and preserve logs, emails and screenshots. A full wipe or reinstallation may result in the loss of evidence, so consult a qualified specialist regarding the investigation. In the meantime, the manager should appoint a decision-maker and a single point of contact for clients. In the initial communication, state only verified facts, identify any unknown circumstances, and promise a specific date for the next update.
At the same time, it is worth clarifying three questions. Which orders and data are affected? Is there a personal data breach to which the GDPR’s standard 72-hour deadline for reporting to the authorities—calculated from the time of becoming aware of the breach—may apply? Does the contract stipulate a separate, possibly shorter, deadline for notifying partners? The answer cannot wait for the full forensic report: the initial facts and immediate actions must be documented with a timestamp and then updated as new information becomes available. If the organisation itself is subject to NIS 2 requirements, it must also apply the cybersecurity reporting procedure separately.
In the week following the incident, the organisation should compare the actual downtime with the estimated downtime. Which backups worked, which point of contact was available, and which contract caused the greatest exposure? This can form the basis of a brief corrective action plan, setting out who is responsible and by when. When requesting a quote in future, the lessons learnt documented in this way provide better evidence than a general statement that the company is ‘secure’.
Cyber security is part of a smaller company’s delivery capability too. The best outcome is not a file on a shelf, but rather that, in the event of an incident, the service is restored more quickly, the partner receives clear information, and the company can demonstrate the steps it has taken.
Sources and further information
• Act LXIX of 2024 – National Legislation Database
Vélemény, hozzászólás?