EMEA businesses siphoning budgets to hit NIS2 goals

With the European Union’s (EU) NIS2 regulations now in full effect, IT leaders across the region report that they are struggling to secure budget to support their compliance efforts, with 95% reporting they are being forced to dip into funds reserved for other things.

This is according to a Censuswide study of EMEA IT leaders commissioned by backup and security specialist Veeam Software, which found that while most are fairly confident about meeting their compliance goals, the NIS2 directive is amplifying other challenges.

The study found that while 68% of companies had received the necessary additional budget for NIS2 compliance, 34% had done so by siphoning cash from their risk management budgets, 30% from recruitment, 29% from crisis management, and 25% from emergency reserves.

“Securing adequate budget for cyber security is often a challenge for IT leaders, but the strict penalties and emphasis on corporate accountability from NIS2 may help ease that process,” said Veeam’s EMEA field CTO, Edwin Weijdema.

“However, as most IT budgets are either being cut or remaining stagnant – effectively shrinking due to rising business costs and inflation – NIS2 is pulling from an already limited pool. It’s particularly concerning to see funds being redirected from recruitment and emergency reserves. NIS2 shouldn’t be treated as a crisis, yet one in four businesses appear to view it that way.”

When coupled with overall reductions in IT budget – Veeam found that 40% of surveyed organisations had had to cut their IT budgets since Brussels secured political agreement on the directive in January 2023 – the reallocation underscores a sense of growing strain on financial resources that are already stretched very thin.

Indeed, said Veeam, with 80% of EMEA IT budgets now being allocated to cyber security and compliance in organisations in scope of the NIS2 regulations, there is little capacity to address more pressing challenges, such as recruiting to fill empty tech roles, and enabling wider digital transformation.

“Maintaining security and compliance is vital for any organisation, but the fact that it currently consumes most of the IT budget highlights how underprepared and under-resourced organisations are,” said Andre Troskie, EMEA field CISO at Veeam. 

“IT leaders have limited budgets, yet still need to find the resources to meet NIS2 requirements quickly. Those who adopt a holistic approach to security and best practices before legislation mandates them will naturally face less pressure, allowing them to better address other key priorities and challenges.”