The European Union’s NIS2 cybersecurity directive has significant implications for African businesses trading with the continent, says cybersecurity firm Check Point, which urges African businesses with strong ties to the EU to take steps to comply with this new, stringent cybersecurity regulation.
The European Union’s NIS2 Directive came into effect this month and requires member states to amend their national legislation. The NIS2 Directive imposes strict cybersecurity requirements including enhanced management liability, reporting to authorities, risk management, and business continuity planning – placing African companies trading with the EU under increased scrutiny.
The NIS2 Directive builds upon the original NIS1 Directive introduced in 2016, expanding its scope to cover a wider range of sectors including energy, banking, transport, digital infrastructure, healthcare, food production, and research. More than 80% of European enterprises are now within the scope of this legislation which extends to global supply chain partners – including many businesses in Africa.
Collins Emadau, Check Point partner and director at Westcon, explains: “Europe is still Africa’s leading trading partner. African businesses – particularly in leading economies such as South Africa, Kenya, and Nigeria – need to understand the far-reaching impact of NIS2. Compliance is not just about meeting EU standards – it’s about securing their future in a globalised market.
Failure to comply will result in not only heavy fines, but also the potential loss of critical trade partnerships with EU member states.”
What’s at stake for African businesses?
The EU remains the largest trading partner for Africa with over 18 Economic Partnership Agreements and trade worth billions annually. African businesses, especially in sectors like energy, banking, transport, and manufacturing are key partners in the EU’s supply chains. To continue doing business with EU companies, African organisations must comply with NIS2 which mandates strict cybersecurity measures to protect critical infrastructure and supply chains.
Issam El Haddioui, head of Security Sales Engineering: Africa, Check Point Software Technologies, says: “NIS2 sets a new standard for cybersecurity – and African businesses must act now. Many organisations are unaware of the depth of these requirements which go beyond local regulations. Compliance is essential not only for maintaining business relationships with the EU, but also for enhancing the overall resilience of African economies against cyberthreats.”
Compliance will exact a cost for African organisations which, according to Interpol’s 2021 Africa Cyberthreat Assessment Report, spends an average of only 0,05% of their revenue on cybersecurity – far below the global average of 0,3% to 0,5%.
The report also estimates the financial impact of cybercrime in the region at over $4-billion, representing about 10% of Africa’s total GDP.
Tougher penalties and personal responsibility
NIS2 introduces personal liability for business leaders in the event of a cyberattack meaning that executives themselves can be held financially accountable for breaches. Penalties include fines of up to EUR7-million or 1,4% of a company’s global annual turnover, whichever is higher. This goes beyond the GDPR, placing even more responsibility on corporate leadership to ensure robust cybersecurity practices are in place.
NIS2 mandates that organisations must report cyber incidents to authorities promptly and inform their stakeholders, suppliers, and customers. Therefore, African businesses must ensure they have a comprehensive incident response plan in place – along with regular cybersecurity training for both IT and leadership teams.
Steps for African businesses to ensure compliance
To successfully implement NIS2 and avoid devastating penalties, Check Point recommends the following four steps for African businesses:
- Knowledge: Business leaders must gain a basic understanding of cybersecurity to effectively communicate with their IT teams and ensure sound decision-making.
- People: Establish an agile IT security department including key roles such as a Data Protection Officer (DPO) and a Chief Information Security Officer (CISO) to manage and distribute responsibilities efficiently.
- Audit: Conduct regular risk assessments and audits to identify and mitigate vulnerabilities. Continuous monitoring is essential to stay compliant with evolving threats.
- Incident Management: Develop clear procedures for responding to cyber incidents including swift reporting to national authorities, suppliers, and stakeholders.
Long-term commitment to cybersecurity
Compliance with NIS2 is not a one-time process – it requires a long-term commitment to cybersecurity. From 2028, organisations will be required to annually document their NIS2-compliant IT infrastructure and demonstrate that their cybersecurity measures are aligned with the latest technological advancements.
“African countries, especially economic leaders like South Africa, Kenya, and Nigeria should also consider using the NIS2 framework as a model for strengthening their own national cybersecurity regulations,” El Haddioui says. “By improving cyber readiness, African businesses not only comply with international standards, but also protect their data, operations, and reputations from evolving threats.
“The NIS2 Directive marks a significant shift in the cybersecurity landscape. African business leaders must recognise that cybersecurity is now a matter of survival, not just compliance. By taking proactive measures, they can safeguard their future, avoid heavy penalties, and ensure their organisations thrive in an increasingly interconnected global economy.”