A tough new EU cyber law is off to a messy start, with many countries failing to adopt the rules
Businesses have been working hard to shift their culture internally to ensure they’re taking the threat of cyber breaches and outage incidents seriously.
Andrew Brookes | Image Source | Getty Images
New European Union regulations requiring businesses to bolster their cyber defenses is off to a slow start as many member states have failed to adopt the rules in time to meet a key enforcement deadline, according to research monitoring the progress of the directive.
The EU’s NIS 2 cybersecurity directive sets a high benchmark for companies over their internal cybersecurity systems and practices. It imposes tougher requirements around risk management, transparency obligations and business continuity planning, in the event of a cyber breach.
On Thursday, the new directive officially became enforceable by member states. That means firms have to now ensure their operations are up to scratch with the rules. However, most EU member states have yet to implement NIS 2 in their own respective national laws, meaning that enforcement is likely to be spotty.
Two countries — Portugal and Bulgaria — haven’t begun the transposition process for NIS 2, where directives are incorporated into the national laws of EU member states, according to a tracker tool from internet research organization DNS Research Federation. The governments of Portugal and Bulgaria were not immediately available for comment when contacted by CNBC Wednesday.
“The implementation status varies significantly across the bloc,” Tim Wright, partner and technology lawyer at Fladgate, told CNBC via email.
What is NIS 2?
NIS 2 — or the Network and Information Security Directive 2 — is an EU directive that aims to increase the security of IT systems and networks across the bloc. First proposed in 2020, the law serves as an update to an earlier directive simply called NIS.
NIS 2 expands the scope of its predecessor to address more recent cybersecurity challenges and threats, as criminals have found new ways to hack companies and compromise their sensitive data.
The directive applies to organizations that operate within the EU and provide essential services to consumers, including banks, energy suppliers, health care institutions, internet providers, transport firms, and waste processors.
Businesses will have a “duty of care” to report and share information on cyber vulnerabilities and hacks with other companies under the new regulation — even if it means owning up to being a victim of a cyber breach.
If a business falls victim to a cyber breach, they’ll have 24 hours to submit an early warning notification to authorities — a stricter timeline than the 72-hour window firms have to notify authorities about a data breach under the General Data Protection Regulation, a separate data privacy law in the EU.
Firms will also have to vet their technology vendors one by one for cyber threats and vulnerabilities.
Will it be effective?
Fladgate’s Wright said that effectiveness of NIS 2 as a regulation will largely depend on consistent implementation and enforcement across EU member states.
“Bad actors may target countries lagging in their NIS2 transposition or look for weaknesses in supply chains, targeting smaller, less-secure vendors and suppliers to gain access to larger, better-protected organisations,” he told CNBC.
Businesses have been working to get their internal processes, controls and broader culture around cybersecurity into shape for years ahead of the Thursday deadline.
Chris Gow, enterprise tech firm Cisco’s EU public policy lead, said that the spotty nature of NIS 2’s implementation has also been “exacerbated by local adaptation of the law.”
This, in turn, is “creating discrepancies that can prove difficult to navigate, especially for smaller organisations with limited resources,” Gow told CNBC in emailed comments.
He recommended that, rather than being “overwhelmed” by discrepancies in local adaptations of NIS 2, organizations should “identify a common core of security controls and processes that stand them in good stead to both meet and demonstrate compliance at scale.”
What if a company fails to comply?
For “essential” entities like transport, finance and water companies, failure to comply with NIS 2 can lead to fines of up to 10 million euros ($10.9 million) or 2% of global annual revenues — whichever ends up higher.
Meanwhile, “important” businesses — such as food companies, chemicals firms, and waste management services — are looking at fines of up to 7 million euros or 1.4% of their global annual revenues for breaches.
Firms can also face possible suspensions of service if they fail to comply with NIS 2, as well as closer supervision.
“NIS 2 makes it clear – large fines, possible suspension of service and monitoring of compliance are being used as levers to encourage organisations responsible for critical services to pay attention to cybersecurity threats and their response to those,” Carl Leonard, EMEA cybersecurity strategist at Proofpoint, told CNBC.
“A baseline has been set in terms of risk-management and mitigation measures including incident handling, staff training, leadership accountability and many others,” Leonard added.
Technology
U.S.-listed shares of TSMC rise 7% in premarket after quarterly profit soars on AI demand
An image of a semiconductor wafer at the Taiwan Semiconductor Manufacturing Museum of Innovation in Hsinchu, Taiwan, on Jan. 11, 2022.
I-Hwa Cheng | Bloomberg | Getty Images
Taiwan Semiconductor Manufacturing Company on Thursday reported a 54% hike in net profit in the third quarter and forecast annual revenue growth in the last three months of the year, as global chipmakers continue to benefit from demand boosted by AI applications.
The company’s net income was 325.3 billion Taiwanese dollars ($10.1 billion) over the July-September quarter, surpassing an LSEG estimate of $300.2 billion Taiwanese dollars cited by Reuters.
U.S.-listed shares were up 6.62% at 4:39 a.m. ET in premarket trading.
TSMC is the world’s largest producer of advanced chips, serving clients such as Apple and Nvidia.
Net revenue came in at $23.5 billion in the third quarter, up 36% year-on-year, with TSMC’s gross margin rising to 57.8% over July-September, compared with 54.3% in the same period of last year.
“Based on the current business outlook, we expect for our fourth-quarter revenue to be between $26.1 billion and $26.9 billion, which represents a 13% sequential increase or a 35% year-over-year increase at the midpoint,” TSMC Chief Financial Officer Wendell Huang said during an earnings call following the results release, according to a call transcript produced by FactSet.
In the third quarter, “our business was supported by strong smartphone and AI-related demand for our industry leading 3nm and 5nm technologies,” TSMC said in a statement, referencing its semiconductor nodes.
In the Thursday earnings call, TSMC Chairman and CEO C.C. Wei stressed that AI demand is “real” and that the company has experienced the “deepest and widest growth of anyone in this industry,” as a result.
“We have talked to our customers all the time, including our hyperscaler customers who are building their own chips. And almost every AI innovator is working with TSMC,” he said.
The company’s Taipei-listed shares have soared nearly 80% year-to-date, outpacing the 28.57% gains of the broader market over the same period.
TSMC now anticipates its capital expenditure for this year will pick up to slightly higher than $30 billion, it said during its earnings call. The firm’s capex costs edged higher to $6.4 billion in the third quarter, versus $6.36 billion across the three preceding months.
The Taiwanese chipmaker, whose advanced chips are vital to a swathe of products ranging from smartphones to AI applications, has been increasing its manufacturing presence worldwide, carrying out a vast overseas investment of $65 billion for three chip plants in Arizona to meet U.S. demand, as well as opening its first factory in Japan earlier this year.
TSMC’s earnings beat comes the same week as Netherlands-based ASML, which supplies machines to the Taiwanese company, issued a lower-than-expected forecast of net sales, sending shares tumbling.
Some market participants have questioned the long-term resilience of the AI boom and the return on increasing investments in the technology sector — while Young Liu, CEO and chairman of key Apple supplier Foxconn, told CNBC last week that the AI frenzy “still has some time to go,” as advanced language models evolve with each new iteration.
Correction: This article has been updated to accurately reflect that TSMC’s third-quarter net income hit 325.3 billion Taiwanese dollars.
Stanley Druckenmiller at CNBC’s Delivering Alpha on Sept. 28, 2022.
Scott Mlyn | CNBC
Billionaire investor Stanley Druckenmiller said on Wednesday that his decision to sell out of Nvidia this year was a “big mistake.”
“I’ve made so many mistakes in my investment career — one of them was I sold all my Nvidia probably somewhere between $800 and $950,” Druckenmiller said in an interview on Bloomberg. “I own none and I owned none the last 400 points.”
Druckenmiller’s comments do not reflect Nvidia’s 10-for-1 stock split, which went into effect in June. The stock closed Wednesday at $135.72. On a split-adjusted basis, his sales would have taken place at between $80 and $95.
Nvidia has been the primary beneficiary of the artificial intelligence boom, selling its graphics processing units, or GPUs, to top cloud companies and the biggest developers of large language models. The stock soared 239% last year and is up another 174% in 2024, closing at a fresh record on Monday.
Earlier this year, Druckenmiller revealed on CNBC’s “Squawk Box” that he cut his Duquesne Family Office’s position in Nvidia in late March, saying “we’ve had a hell of a run.”
Taking the split into account, Duquesne owned about 6.18 million shares at the start of the year, 1.76 million at the end of the first quarter and 214,000 when the second quarter closed. In the third quarter of last year, Nvidia was his top holding. At the time, he owned 8.75 million shares worth around $400 million.
If he held onto that entire stake, it would currently be worth about $1.19 billion. Duquesne has not released its third-quarter holdings yet.
“It tripled in a year, and I thought the valuation was rich,” Druckenmiller told Bloomberg. “Nvidia is a wonderful company and were the price to come down, we’d get involved again. But right now, I’m licking my wounds from a bad sale.”
Nvidia is expected to release quarterly results in November, but most of its top customers, including Meta, Microsoft, Amazon and Alphabet, will report financials later this month.
Druckenmiller told CNBC in May that Nvidia was “a little overhyped now, but underhyped long term.” He added that he was introduced to Nvidia in 2022, when “I didn’t even know how to spell it.”
Kindle Colorsoft 2024
Amazon
Amazon on Wednesday announced a new Kindle e-reader, and for the first time ever it has a color display.
The retailing giant introduced the Kindle in 2007, and every device since then has had a black-and-white screen. The new Kindle has a display that’s designed to ensure colors don’t appear washed out or pixelated, even when users zoom in on images.
The $279 device, which Amazon is calling the Kindle Colorsoft, has “weeks of battery life,” the company said. It can be preordered now and ships on Oct. 30.
Amazon also unveiled a refreshed $399 Kindle Scribe with new note-taking features, an updated $159 Kindle Paperwhite and a 12th generation Kindle, which costs $109. At a press event in New York on Tuesday, Amazon’s devices chief, Panos Panay, called the updates the “largest single refresh that the Kindle lineup has ever had.”
Kindle Lineup 2024
Amazon
The Kindle Scribe, which Amazon introduced in 2022, comes with a pen that allows users to take notes, make to-do lists and write directly on the pages of the book they’re reading. With the new note-taking feature, called Active Canvas, users can take notes directly on an e-book’s pages and the text will automatically shift to flow around it. They’ll also be able to take notes in the margins of the book and hide them for later.
The Kindle Scribe includes another new feature that uses generative artificial intelligence to summarize pages of notes into a concise list. Amazon said the feature uses Bedrock, a software tool that lets users access large language models from Amazon and other companies like Anthropic and Stability AI. The device is available for preorder now and ships Dec. 4.
The new Kindle Paperwhite is faster than previous models, and also features a larger, 7-inch display, up from 6.8 inches on the prior version. Amazon says the 12th generation Kindle is its most “compact” e-reader ever, with a brighter display. Both devices are available starting Wednesday.
-
Sports2 years ago‘Storybook stuff’: Inside the night Bryce Harper sent the Phillies to the World Series
-
Sports6 months agoStory injured on diving stop, exits Red Sox game
-
Sports2 years agoMLB Rank 2023: Ranking baseball’s top 100 players
-
Sports12 months agoGame 1 of WS least-watched in recorded history
-
Environment1 year agoJapan and South Korea have a lot at stake in a free and open South China Sea
-
Sports3 years ago
Team Europe easily wins 4th straight Laver Cup
-
Environment2 years agoGame-changing Lectric XPedition launched as affordable electric cargo bike
-
Business2 years agoBank of England’s extraordinary response to government policy is almost unthinkable | Ed Conway