From NIS2 to SASE: The New Map of Corporate Cybersecurity

The corporate cybersecurity can no longer be understood as a set of isolated tools. The arrival of the NIS2 Directive, the increase in hybrid work, the dependence on cloud and the professionalization of cybercrime have transformed the approach to security in companies. Today, protecting a company demands strategic vision, regulatory compliance, and architectures capable of securing users, data, applications, and networks from anywhere.

In this new scenario, concepts like NIS2, SASE, Zero Trust, SD-WAN o risk management They are no longer technical terms reserved for the IT department. They are now part of business continuity, customer trust, and management responsibility.

NIS2: Much more than a regulatory obligation

The NIS2 Directive created to raise the level of cybersecurity in the European Union. It replaces the previous NIS1 and expands its scope with a more demanding framework, greater supervision, and strengthened obligations for many organizations considered essential or important.

This means that cybersecurity is no longer a recommendation but an organizational requirement. Affected companies must adopt technical, operational, and management measures to reduce risks, prevent incidents, and respond appropriately if they occur.

The NIS2 Directive covers sectors that are considered critical or essential, divided into two categories: **1. Essential Entities:** * **Energy:** Electricity, oil and gas (exploration, production, refining, distribution, storage, retail) * **Transport:** Air, sea and inland waterways, rail, road * **Banking:** Credit institutions * **Financial Market Infrastructure:** Trading venues, central counterparties, central securities depositories, central banks, payment service providers * **Health:** Healthcare providers, medical device manufacturers, medicinal product manufacturers, wholesale distributors of medicinal products * **Drinking Water:** Suppliers and distributors of water for human consumption * **Digital Infrastructure:** Internet access providers, domain name registrars, top-level domain name registries, cloud computing service providers, data centre service providers, networks and electronic communication services * **Information Society Services:** Online marketplaces, online search engines, social networking service platforms * **Public Administration:** The central government administration * **Space:** Service operators of ground-based space infrastructure **2. Important Entities:** * **Food:** Production, processing, and distribution of food * **Manufacture of:** Certain essential products such as chemicals, metals, electronics, machinery, vehicles, and manufactured goods * **Postal and Courier Services:** Providers of postal and courier services * **Waste Management:** Waste management services * **Chemicals:** Production and distribution of chemicals * **Digital Providers:** Providers of electronic communications networks and services, as well as trusted list services * **Research:** Research organisations The NIS2 Directive aims to broaden the scope of cybersecurity regulations compared to its predecessor, NIS1, by including more sectors and increasing the obligations for these entities.

NIS2 doesn't just ask for more technology. Its approach is much broader. Among its points, depending on the type of entity and its key level of impact, are:

• Evaluate and manage cybersecurity risks.
• Protect critical networks, systems, and services.
• Improve incident response.
• Strengthen supply chain security.
• Apply business continuity policies.
• Involve management bodies in decision-making.
• Report relevant incidents according to established procedures.

INCIBE points out that the Directive includes a minimum set of technical, operational, and organizational measures for managing the security risks of information systems and networks.

Therefore, complying with NIS2 is not just about “passing an audit.” It's about demonstrate that the company understands its risks, controls them and has a strategy to protect their activity.

The problem with the traditional security model

For years, many organizations have protected their infrastructure with a perimeter-based approach: a central office, users connected from within, and security tools surrounding the corporate network.

That model no longer responds as well to current reality.

Today, employees access from home, from different office locations, from mobile devices, and from external networks. Applications are no longer just on internal servers; many live in cloud environments, SaaS platforms, or hybrid infrastructures.

The result is clear: The classic perimeter has been diluted.

New risks for modern businesses

This change has opened new gaps:

• Lack of protection in remote access.
• App Usage cloud without visibility.
• Devices and locations outside the traditional perimeter.
• External providers with access to internal systems.
• Security policies vary by office, user, or tool.
• Difficulty detecting anomalous behaviors in real time.

This is where it comes into play SASE.

What is SASE and why is it gaining prominence

SASE, acronyms for Secure Access Service Edge, It is a model that combines network and security functions in a unified cloud architecture. It integrates capabilities of connectivity, secure access, web protection, control of cloud y Firewall in the cloud to protect user access, locations, devices, and applications from anywhere.

Instead of forcing all traffic through a central office or data center, SASE brings security closer to the user and the application. This enables a more efficient, flexible, and secure connection.

Core Components of a SASE Architecture

One SASE strategy usually includes:

1. SD-WAN. Optimize connectivity between sites, users, and applications, prioritizing performance, availability, and efficiency.
2. ZTNA. Replace traditional VPNs' broad access with a model based on identity, context, and least privilege.
3. SWG. Protects web browsing from threats, dangerous downloads, phishing, and unauthorized content.
4. Cloud Access Security Broker. Provide visibility and control over application usage. cloud and SaaS platforms.
5. Firewall-as-a-Service. Translate advanced firewall capabilities to a model cloud, more scalable and centralized.
6. Unified management. Allows applying consistent policies to users, locations, devices, and environments cloud.

NIS2 and SASE: two pieces of the same map

Although NIS2 and SASE they belong to different planes, they are closely related. The first establishes a framework for responsibility and compliance. The second offers a technological architecture that helps to respond better to those challenges.

NIS2 requires more mature risk management. SASE can help advance this maturity by centralizing policies, improving visibility, and protecting access in distributed environments.

SASE can help in a strategy aligned with NIS2 by providing a unified, cloud-native platform that integrates network security and wide-area networking (WAN) capabilities. This integration is crucial for meeting NIS2's requirements for robust cybersecurity measures, risk management, and incident response, especially for organizations with distributed workforces and complex IT environments. Here's how SASE specifically supports NIS2 alignment: * **Enhanced Threat Protection:** SASE consolidates various security functions like Secure Web Gateway (SWG), Cloud Access Security Broker (CASB), Zero Trust Network Access (ZTNA), and Firewall-as-a-Service (FWaaS) into a single, cloud-delivered service. This provides comprehensive, consistent enforcement of security policies across all users, devices, and applications, regardless of location. This aligns with NIS2's focus on strong security measures to prevent and minimize the impact of cyber incidents. * **Improved Visibility and Control:** By centralizing network traffic inspection and security policy management, SASE offers deep visibility into network activity and user behavior. This enhanced visibility is essential for identifying potential threats, understanding attack vectors, and complying with NIS2's requirements for monitoring and reporting. * **Simplified Security Architecture:** A SASE architecture reduces complexity by replacing multiple point security solutions with a single, integrated platform. This simplification makes it easier for organizations to manage and maintain their security posture, which is beneficial for meeting NIS2's demands for effective security management. * **Zero Trust Principles:** SASE inherently supports Zero Trust Network Access (ZTNA), which operates on the principle of "never trust, always verify." This means that access to resources is granted on a least-privilege basis after strict verification of users and devices. This aligns perfectly with NIS2's emphasis on robust access controls and reducing the attack surface. * **Consistent Policy Enforcement:** SASE ensures that security policies are applied uniformly across the entire network, whether users are in the office, remote, or accessing cloud applications. This consistent enforcement is vital for meeting NIS2's requirement for uniform security standards and preventing security gaps. * **Streamlined Incident Response:** The centralized nature of SASE can facilitate more efficient incident detection and response. With unified logging and monitoring, security teams can more quickly identify the scope of an incident and take appropriate action, a key requirement under NIS2. * **Adaptability to Evolving Threats:** As a cloud-native solution, SASE is agile and can be easily updated to address new and evolving threats. This adaptability is crucial for staying ahead of the dynamic threat landscape that NIS2 aims to address. * **Support for Remote Work and Cloud Adoption:** SASE is purpose-built for modern, distributed environments where users access resources from anywhere and applications reside in the cloud. This inherent support is critical as many organizations impacted by NIS2 will have these characteristics. In essence, SASE provides the foundational technology and architectural approach that enables organizations to build and maintain a cybersecurity strategy that is robust, adaptable, and aligned with the comprehensive security and risk management requirements mandated by NIS2.

An architecture SASE can contribute to:

• Control who accesses which resources.
• Reduce internal application exposure.
• Apply uniform security policies.
• Improve the traceability of connections and access.
• Strengthen protection against web threats.
• Protect remote users and distributed sites.
• Simplify the management of vendors and third parties.
• Improve detection and response capabilities.

This does not mean that SASE, by itself, guarantees NIS2 compliance. The regulation requires governance, processes, documentation, training, risk assessment, and organized response. However, SASE can become a solid technological foundation for moving towards that model.

From Reactive Compliance to Strategic Security

One of the most common risks is address NIS2 as a one-time obligation. Cybersecurity should not only be activated when an audit arrives or a threat appears.

This new context requires a shift from reactive security to strategic security.

This implies:

• Know the organization's critical assets.
• Identify vulnerabilities and dependencies.
• Prioritize risks by real impact.
• Design a progressive roadmap.
• Integrate security, connectivity, and compliance.
• Raise awareness among technical and management teams.
• Continuously review policies and controls.

The key is not having more tools, but building a coherent ecosystem.

What should companies do now

To adapt to this new environment, organizations should start with a realistic assessment of their current situation.

Recommended first steps

1. Analyze if the organization is within the scope of NIS2. Determine if the company falls within the scope of application and what requirements it must consider.
2. Audit access, networks, and applications. Review how users, sites, vendors, and devices connect.
3. Identify security gaps. Detecting VPN weaknesses, firewalls, permissions, environments cloud monitoring capability.
4. Define a Zero Trust strategy. Apply the principle of least privilege and validate each access based on identity and context.
5. Assess a transition to SASE when it makes sense for structure, locations, users, or applications. Integrate connectivity and security into a more scalable, centralized, and future-proof model.

Conclusion: Cybersecurity is already a business decision

NIS2 marks a turning point in how companies must understand corporate cybersecurity. It's no longer enough to protect the perimeter or react when an incident occurs. Now it's necessary to anticipate, demonstrate control, protect the entire digital chain, and secure access from anywhere.

In this context, SASE positions itself as an increasingly relevant architecture for organizations that need security, connectivity, flexibility, and compliance within a single model.

If your company wants to prepare for this new scenario, IPVIP can help you analyze your current situation, identify risks, and design a cybersecurity strategy aligned with NIS2, SASE, and your business's actual needs.

At IPVIP, we can help you. To analyze your current situation, identify risks, and define a roadmap aligned with your security, connectivity, and compliance needs.