EU NIS2 Directive

The EU NIS Directive (EU 2016/1148), created to establish a common baseline for network and information security across Member States, is being updated to NIS2 to improve cyber resilience and broaden the range of organizations in scope. The update reflects how digital transformation—accelerated by the COVID-19 period—has increased dependence on network-delivered services, expanded the attack surface, and raised the potential impact of cyber incidents. High-profile attacks with wide operational and societal consequences are used to justify the need for substantial changes rather than incremental improvements.

NIS2 focuses on stronger EU-wide cooperation and coordination, including coordinated vulnerability disclosure, crisis coordination through EU-CyCLONe, and greater use of certification schemes and recognized standards. It also introduces measures such as domain name registration data databases. The directive merges prior categories (operators of essential services and digital service providers) into “essential” and “important” entities and expands sector coverage to include areas such as digital infrastructure, electronic communications, social networks, waste and water management, manufacturers of critical products (e.g., pharmaceuticals), ground infrastructure supporting space-based services, food, and parts of public administration. Member States retain discretion in designating certain entities, such as sole providers of essential services within a country.

Core obligations include more explicit governance expectations: board-level training, senior management accountability, risk analysis, supply-chain risk management, and operational capabilities to prevent, detect, respond to, and recover from incidents, supported by basic cyber hygiene and training. Reporting requirements become more stringent with staged notifications at 24 hours, 72 hours, and a final report within one month. Enforcement is strengthened through supervisory powers and significant administrative fines, scaled by entity type and worldwide turnover.

• The original NIS Directive is identified as (EU 2016/1148) and was adopted in 2016.
• Political agreement across the EU to adopt the proposed NIS2 update occurred in May 2022.
• Member States must transpose the updated directive into national law within 21 months after publication in the Official Journal.
• NIS2 provides for coordinated vulnerability disclosure for newly discovered cyber vulnerabilities across the EU (Article 6).
• EU-CyCLONe is included to support coordinated management of large-scale cybersecurity incidents and crises at EU level (Articles 7–14).
• NIS2 requires an early warning notification within 24 hours of becoming aware of an incident.
• NIS2 requires an incident notification within 72 hours of becoming aware of an incident.
• A final incident report is required no later than one month after submitting the incident notification.
• Administrative fines can reach up to €10 million or 2% of total worldwide turnover for essential entities, whichever is higher.
• Administrative fines can reach up to €7 million or 1.4% of total worldwide turnover for important entities.

• “Incremental improvements will not give us the security we need; instead, the Federal Government needs to make bold changes and significant investments.”
• “All Member States need to adopt a national strategy on the security of network and information systems.”
• “The digital transformation of society (intensified by the COVID-19 crisis) has expanded the threat landscape and is bringing about new challenges which require adapted and innovative responses.”
• “The basic obligations that NIS2 places on organizations are to implement good cyber hygiene.”
• “This is not rocket science, it simply involves ensuring that the wide range of routine cyber security tasks are correctly performed, monitored, and continuously improved.”
• “The responsibilities for meeting the obligations for cyber resilience extend beyond the IT service delivery group and include everyone across the organization.”
• “Management bodies must approve the cybersecurity risk management measures taken to comply with Article 18, oversee its implementation and can be held liable for the non-compliance by the entities with their obligations.”
• “Organizations should review and update their processes for detecting and reporting on cyber incidents where necessary to ensure that they meet with these obligations.”
• “KuppingerCole recommends that organizations adopt the concept of a security fabric to support a consistent approach to security and compliance across the various delivery models (on premises, managed services, and cloud).”
• “It helps to control costs while ensuring effectiveness by identifying the right tools to cover all the cyber security needs.”