Cybersecurity Standards for Trading Companies: ISO 27001 and NIS2 Compliance

Cybersecurity has moved from a peripheral IT concern to a board-level strategic priority for trading companies, driven by a dramatic increase in the frequency and severity of attacks targeting commercial and financial operations. Business email compromise (BEC) fraud — where attackers intercept and redirect payment instructions — has proved particularly costly for trading companies, with individual incidents resulting in losses of hundreds of thousands to millions of dollars.\n\nThe 2023 compromise of a mid-sized metals trading company based in the Netherlands, in which attackers monitored email communications for six weeks before substituting fraudulent bank details on a €2.3 million payment instruction, illustrates the sophistication and patience of modern cyber threats targeting trading operations.\n\nISO 27001: THE GOLD STANDARD FOR INFORMATION SECURITY\nISO 27001 is the international standard for information security management systems, providing a comprehensive framework for identifying, assessing, and systematically managing information security risks. Certification requires an organisation to implement 93 security controls across 11 domains, undergo third-party assessment, and maintain an ongoing management system with annual surveillance audits.\n\nFor trading companies, the most valuable ISO 27001 controls address the specific attack vectors most commonly exploited against commercial operations: email security (anti-phishing, anti-BEC), access control (who can authorise and execute financial transactions), supplier security (the systems of logistics providers and other third parties with access to operational data), and incident response (how to contain and recover from a security breach).\n\nNIS2: EUROPEAN REGULATORY REQUIREMENTS\nThe Network and Information Security Directive 2 (NIS2), which entered into force across EU member states in 2024, imposes mandatory cybersecurity requirements on a broad range of 'essential' and 'important' entities. While most mid-market trading companies will not be directly in scope, companies in sectors defined as important — including food distribution and energy — may be subject to the Directive's requirements.