NIS2 Directive

What it is

Directive (EU) 2022/2555 is the EU's main cybersecurity law for organisations that provide services society depends on. It replaced the first NIS Directive, widened the range of sectors covered and set common minimum security measures, incident reporting duties and supervision across member states. Because it is a directive, the obligations reach organisations through national transposition laws.

Who it applies to

• Essential entities: mainly large organisations (250 or more staff, or turnover above 50 million euro and balance sheet above 43 million euro) in the sectors of high criticality in Annex I: energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management (business to business), public administration and space
• Important entities: medium-sized and large organisations in Annex I or Annex II sectors that are not essential; Annex II covers postal and courier services, waste management, chemicals, food, manufacturing of products such as medical devices, electronics, machinery and vehicles, digital providers (online marketplaces, search engines, social networks) and research
• Some entities are in scope regardless of size, such as qualified trust service providers, top-level domain registries, DNS service providers and certain public administration bodies
• Member states may also designate smaller entities that are the sole provider of a critical service or whose disruption would have a significant impact
• Financial entities covered by DORA follow DORA for ICT risk management and incident reporting, as DORA is the more specific law

Key points

• Management bodies must approve the cybersecurity risk-management measures, oversee their implementation, follow training, and can be held liable for infringements (Article 20)
• Article 21 requires an all-hazards set of measures, including risk analysis and policies, incident handling, business continuity and crisis management, supply chain security, secure development and vulnerability handling, effectiveness assessment, cyber hygiene and training, cryptography, HR security and access control, asset management, and multi-factor authentication where appropriate
• Significant incidents must be reported to the CSIRT or competent authority in stages: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month (Article 23)
• Supply chain security means assessing the security practices and vulnerabilities of direct suppliers and service providers
• Entities must register with national authorities, and certain digital providers fall under the jurisdiction of the member state of their main establishment
• For digital infrastructure and digital service providers the measures are detailed in Implementing Regulation (EU) 2024/2690

Where to start

1. 1Determine whether you are an essential or important entity, or out of scope, using the sector annexes, size thresholds and the national transposition law of each country you operate in
2. 2Register with the competent authority where your national law requires it
3. 3Run a gap assessment against the Article 21 measures and give the management body a plan and budget to approve
4. 4Set up an incident classification and reporting process that can meet the 24 hour, 72 hour and one month deadlines