Virtually all UK organizations have been forced to divert funds from elsewhere to deal with the costs of NIS2 compliance.
The EU cybersecurity bill NIS2 came into effect earlier this year, with the deadline for compliance having recently passed.
Under the legislation, EU-based businesses operating in critical sectors such as energy, transport, water, financial services, and healthcare, are required to implement tough security safeguards and reporting practices.
While it doesn't directly affect UK organizations, those that do business with EU entities must comply.
In a recent study from Veeam Software, two-thirds of companies said they were being given the necessary extra budget for NIS2 compliance, but 95% revealed they had been forced to divert funds from elsewhere.
A third said they had dipped into their risk management budgets, 30% from wider recruitment, 29% from crisis management, and 25% from emergency reserves.
"Securing adequate budget for cybersecurity is often a challenge for IT leaders, but the strict penalties and emphasis on corporate accountability from NIS2 may help ease that process,” said Edwin Weijdema, field CTO EMEA at Veeam.
“However, as most IT budgets are either being cut or remaining stagnant — effectively shrinking due to rising business costs and inflation — NIS2 is pulling from an already limited pool.
"It's particularly concerning to see funds being redirected from recruitment and emergency reserves. NIS2 shouldn’t be treated as a crisis, yet one in four businesses appears to view it that way."
The research found that NIS2 isn't really a priority for most organizations, ranking well after the skills gap, profitability concerns, digital transformation, the rising cost of doing business, and a lack of resources.
But in order to become compliant, around three-in-ten companies are conducting IT audits, reviewing cybersecurity processes and best practices, developing new policies and procedures, investing in new technology, and increasing their cybersecurity budget.
Companies required to comply with NIS2 are now spending 80% of their IT budgets on cybersecurity and compliance, the study noted.
"Maintaining security and compliance is vital for any organization, but the fact that it currently consumes most of the IT budget highlights how underprepared and under-resourced organizations are," said Andre Troskie, field CISO EMEA at Veeam.
"IT leaders have limited budgets, yet still need to find the resources to meet NIS2 requirements quickly. Those who adopt a holistic approach to security and best practices before legislation mandates them will naturally face less pressure, allowing them to better address other key priorities and challenges."
The UK has been helped in its efforts to comply with NIS2 by the fact that it was the only country surveyed to report an increase in IT budgets since January 2023, with six-in-ten IT decision makers reporting a budget increase, and just 14% seeing a cut.
As a result, 38% of UK-based respondents have already invested in reviewing cybersecurity processes and best practices, and 34% have invested in new technologies - more than their EU counterparts.
UK IT decision makers also plan to continue significant investments going forward, with 30% intending to further review cybersecurity processes and best practices, and 25% planning new technology investments, compared to an average of 15% and 16% across other surveyed countries.
"Given their readiness to invest and improve, it’s unsurprising that 90% of UK IT decision-makers feel confident in their ability to comply with regulatory requirements — the highest confidence in EMEA," said Dan Middleton, regional vice president of the United Kingdom and Ireland at Veeam.
"This is good news ahead of the upcoming Cyber Security and Resilience Bill. While the details are yet to be released, any moves UK businesses make now to enhance their cyber and data resilience will benefit them when this regulation comes into force.”
