NIS2 Directive: EU Cybersecurity Regulation Guide

The NIS2 Directive is the European Union's updated cybersecurity legislation, significantly expanding the scope and stringency of the original 2016 NIS Directive. It establishes cybersecurity risk management and incident reporting obligations for organizations across a wide range of critical and important sectors.

What NIS2 Covers

NIS2 mandates that covered entities implement appropriate and proportionate cybersecurity risk management measures. Specific requirements include risk analysis policies, incident handling procedures, business continuity management, supply chain security, vulnerability management, cybersecurity testing, cryptography policies, human resource security, access control, and asset management.

The directive introduces a tiered incident reporting regime: a 24-hour early warning to the relevant CSIRT, a 72-hour incident notification with initial assessment, and a final report within one month.

Who NIS2 Affects

NIS2 dramatically expanded its scope compared to the original directive. It covers two categories:

Essential entities — Large organizations in high-criticality sectors including energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, and space.

Important entities — Medium and large organizations in sectors such as postal services, waste management, chemicals manufacturing, food production, medical device manufacturing, digital providers, and research organizations.

Organizations with 50+ employees or EUR 10M+ turnover in covered sectors are generally in scope. Member states may also designate smaller entities as in scope based on criticality.

Compliance Requirements

1. Self-assessment — Determine if your organization falls under NIS2 scope
2. Register — Essential and important entities must register with relevant national authorities
3. Risk management measures — Implement the cybersecurity measures specified in Article 21
4. Incident reporting — Establish processes for the 24-hour/72-hour/1-month reporting regime
5. Supply chain security — Assess and manage risks from suppliers and service providers
6. Management accountability — Ensure management bodies approve and oversee cybersecurity measures
7. Training — Provide regular cybersecurity training including for management bodies

Enforcement and Penalties

NIS2 introduced significant penalties: up to EUR 10 million or 2% of worldwide annual turnover for essential entities, and EUR 7 million or 1.4% of turnover for important entities. Management bodies can be held personally liable for compliance failures, marking a notable escalation from the original directive.