20.500.12556/DKUM-95318 Zagotavljanje skladnosti z direktivo NIS2 v proizvodnem podjetju Compliance assurance with the nis2 directive in a manufacturing company Diplomsko delo obravnava skladnost proizvodnega podjetja z direktivo NIS2, ki določa strožje zahteve za kibernetsko varnost bistvenih subjektov. Namen naloge je bil ugotoviti do kake mere obravnavano proizvodno podjetje izpolnjuje zahteve NIS2 in katere ukrepe mora uvesti za dosego skladnosti. Za oceno skladnosti sta bili izvedeni sistematična analiza obstoječega stanja in analiza vrzeli. Metodologija je temeljila na 21. členu direktive NIS2, modelih zrelosti (ENISA, NIST CSF) ter priporočilih ISO 27001 in ISO 27005. Rezultati kažejo, da podjetje dosega srednjo stopnjo skladnosti. Največje pomanjkljivosti so na področjih poročanja o incidentih, varnosti dobavne verige, ozaveščanja zaposlenih in upravljanja ranljivosti v OT-okolju. Med dobro urejena področja sodijo nadzor dostopov, segmentacija IT/OT in kriptografska zaščita. Na podlagi ugotovitev so bili oblikovani organizacijski, tehnični in procesni ukrepi ter načrt njihove uvedbe po prioritetah. Priporočila vključujejo krepitev povezovanja IT in OT, specializirana usposabljanja za proizvodnjo ter redne presoje skladnosti. Zaključek potrjuje, da ima podjetje dobro osnovo, vendar mora ukrepe nadgraditi, da bo doseglo polno skladnost z direktivo. This thesis examines the compliance of a manufacturing company with the NIS2 Directive, which sets stricter requirements for the cybersecurity of essential entities. The purpose of the study was to determine the extent to which the observed manufacturing company meets the requirements of NIS2 Directive and which measures must be implemented to achieve full compliance. To assess compliance, a systematic analysis of the current state and a gap analysis were carried out. The methodology was based on Article 21 of the NIS2 Directive, maturity models (ENISA, NIST CSF), and the recommendations of ISO 27001 and ISO 27005. The results show that the company achieves a medium level of compliance. The greatest shortcomings were identified in incident reporting, supply chain security, employee awareness, and vulnerability management in the OT environment. Well-established areas include access control, IT/OT segmentation, and cryptographic protection. Based on these findings, organizational, technical, and process measures were developed, along with a prioritized implementation plan. The recommendations include strengthening IT and OT integration, specialized training for production staff, and regular compliance audits. The conclusion confirms that the company has a solid foundation but needs to further improve its measures to achieve full compliance with the Directive. proizvodno podjetje operativna tehnologija kibernetska varnost direktiva NIS2 skladnost manufacturing company operational technology cybersecurity NIS2 Directive compliance true true false Slovenski jezik Angleški jezik Diplomsko delo/naloga 2025-09-12 13:10:57 2025-10-23 09:54:17 2025-10-24 03:23:30 0000-00-00 00:00:00 2025 0 Maribor 0 0000-00-00 NiDoloceno NiDoloceno NiDoloceno 0000-00-00 0000-00-00 0000-00-00 254407683 UN_Puscenik_Maj_2025.pdf UN_Puscenik_Maj_2025.pdf 1 58FDDA10D6E76F1A156E7B69D41BD60A e53a2fd2110c8608348f9ff130aaf14f8661dc7d2ed0c3d05a915ac6e49816a4 c9aadd9e-8fcc-11f0-949c-00155d000105 https://dk.um.si/Dokument.php?lang=slv&id=198308 Fakulteta za organizacijske vede 0 0 0