NIS2 compliance amplifies skills shortages and resource strain

November 2024 Information Security, Security Services & Risk Management

With NIS2 implementation underway across the EU, a new Censuswide survey, commissioned by Veeam Software reveals the significant impact on businesses as they adapt to this key cybersecurity directive. Veeam found that while most IT leaders are confident about meeting NIS2 compliance, the directive has also amplified existing challenges, such as resource limitations and skills shortages.

This survey found that these ‘skills gaps’ are the number one pressure point for EMEA organisations, with 30% saying they have dipped into recruitment budgets to support NIS2 compliance efforts.

The survey exposed that while IT leaders have managed to secure enough budget to meet the NIS2 directive, the impact on other areas could be significant; 68% of companies report receiving the necessary additional budget for NIS2 compliance. However, 20% identified budget as being a significant barrier to achieving compliance. Since the political agreement for NIS2 in January 2023, 40% of businesses have faced decreased IT budgets, and 20% have unchanged financials.

Moreover, 95% of organisations have diverted funds from elsewhere in the business to cover NIS2 compliance costs. Specifically, 34% of companies have dipped into their risk management budgets, 30% from wider recruitment, 29% from crisis management, and 25% from emergency reserves. This reallocation underscores further strain on these companies’ already tight financial resources.

Edwin Weijdema, Field CTO EMEA at Veeam, stated, “Securing adequate budget for cybersecurity is often a challenge for IT leaders, but the strict penalties and emphasis on corporate accountability from NIS2 may help ease that process. However, as most IT budgets are either being cut or remaining stagnant — effectively shrinking due to rising business costs and inflation — NIS2 is pulling from an already limited pool. It is particularly concerning to see funds being redirected from recruitment and emergency reserves. NIS2 should not be treated as a crisis, yet one in four businesses appears to view it that way.”

NIS2 challenges

The survey also highlighted the main business pressures felt by IT leaders. With NIS2 ranking low on the priority list at #10, this emphasises the extensive array of challenges faced at the senior level. The top five challenges are the skills gap (24%), profitability concerns (23%), digital transformation (23%), the rising cost of doing business (20%), and a lack of resources (20%). These findings reveal that human and financial resources are the main limiting factors for IT leaders, yet NIS2 demands both.

To become compliant, companies are taking various steps: conducting IT audits (29%), reviewing cybersecurity processes and best practices (29%), developing new policies and procedures (28%), investing in new technology (28%), and increasing budget allocation for cybersecurity (28%). The primary 'enablers' of NIS2 compliance include new technology solutions (27%), IT audits (25%), and internal organisational skills (25%), which all demand valuable budget and expertise.

Budget dominated by security and compliance

Despite the overall IT budget reductions over the past two years, additional funds have still been allocated for NIS2 compliance – either from the IT budget or elsewhere within the business. This constraint may explain why 80% of EMEA IT budgets are now allocated to cybersecurity and compliance by companies required to comply with NIS2. This leaves little room to address IT leaders' top challenges, such as the skills gap, profitability, and digital transformation.

“Maintaining security and compliance is vital for any organisation, but the fact that it currently consumes most of the IT budget highlights how underprepared and under-resourced organisations are. IT leaders have limited budgets, yet still need to find the resources to meet NIS2 requirements quickly. Those who adopt a holistic approach to security and best practices before legislation mandates them will naturally face less pressure, allowing them to better address other key priorities and challenges,” added Andre Troskie, Field CISO EMEA at Veeam.

Find out more at www.veeam.com




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Cybersecurity a challenge in digitalising OT
Kaspersky Information Security Industrial (Industry)
According to a study by Kaspersky and VDC Research on securing operational technology environments, the primary risks are inadequate security measures, insufficient resources allocated to OT cybersecurity, challenges surrounding regulatory compliance, and the complexities of IT/OT integration.

Read more...
Cybersecurity in South Africa
Information Security
According to the Allianz Risk Barometer 2025, cyber incidents, including ransomware attacks, data breaches and IT outages, are now the top global business risk, marking their fourth year at the top.

Read more...
Are AI agents a game-changer?
Information Security
While AI-powered chatbots have been around for a while, AI agents go beyond simple assistants, functioning as self-learning digital operatives that plan, execute, and adapt in real time. These advancements do not just enhance cybercriminal tactics, they may fundamentally change the battlefield.

Read more...
Disaster recovery vs cyber recovery
Information Security
Disaster recovery centres on restoring IT operations following events like natural disasters, hardware failures or accidents, while cyber recovery is specifically tailored to address intentional cyberthreats such as ransomware and data breaches.

Read more...
Chubbsafes celebrates 190 years
Gunnebo Safe Storage Africa News & Events Security Services & Risk Management
Chubbsafes marks its 190th anniversary in 2025 and as a highlight of the anniversary celebrations it is launching the Chubbsafes 1835, a limited edition 190th-anniversary collector’s safe.

Read more...
New law enforcement request portal
News & Events Security Services & Risk Management
inDrive launches law enforcement request portal in South Africa to support safety investigations. New portal allows authorised South African law enforcement officials to securely request user data related to safety incidents.

Read more...
Continuous AML risk monitoring
Access Control & Identity Management Security Services & Risk Management Financial (Industry)
AU10TIX, launched continuous risk monitoring as part of its advanced anti-money laundering (AML) solution, empowering businesses to detect behavioural anomalies and emerging threats as they arise.

Read more...
Back-up securely and restore in seconds
Betatrac Telematic Solutions Editor's Choice Information Security Infrastructure
Betatrac has a solution that enables companies to back-up up to 8 TB of data onto a device and restore it in 30 seconds in an emergency, called Rapid Access Data Recovery (RADR).

Read more...
The rise of AI-powered cybercrime and defence
Information Security News & Events AI & Data Analytics
Check Point Software Technologies launched its inaugural AI Security Report, offering an in-depth exploration of how cybercriminals are weaponising artificial intelligence (AI), alongside strategic insights defenders need to stay ahead.

Read more...