EU NIS2 Directive

What is NIS2?
The European Union (EU) introduced the Network and Information Security 2 Directive in December 2022 as an update to the original EU cybersecurity rules introduced in 2016. The NIS2 Directive is legislation that modernizes the existing legal framework to keep pace with increased digitization, and an evolving cybersecurity threat landscape.

NIS2 expands the scope of EU cybersecurity rules to new sectors and entities with the goal of improving the resilience and incident response capacities of public and private entities, competent authorities, and the EU as a whole. This new directive is also a positive step for all citizens of the EU because it aims to secure the critical infrastructure that all EU citizens need and rely on.

What’s the difference between NIS and NIS2?
Introduced in 2016, Directive (EU) 2016/1148 (the NIS Directive) was the first piece of EU-wide legislation on cybersecurity. It introduced a significant change in how members states of the EU approached cybersecurity. NIS2 replaces the NIS Directive, providing legal measures to boost the overall level of cybersecurity in the EU. NIS2 also addresses several weaknesses that prevented the NIS Directive from unlocking its full potential. NIS2 widens the scope of the rules to more industries, strengthens risk and incident management and cooperation, and introduces stronger penalties and other compliance requirements to achieve a high, common level of cybersecurity across the EU.

Other critical sectors

• Energy: Electricity, oil, gas, heat, hydrogen
• Health: Healthcare providers, labs, R&D, pharma
• Transport: Air, rail, water, road
• Banks and financial markets
• Water and wastewater
• Digital: IXP, DNS, TLD, DC, CSP, CDN, TSP, MSP, MSSP
• Public administration

Other critical sectors

• Postal and courier
• Waste management
• Chemicals
• Food
• Manufacturing technology and engineering
• Digital services: Social, search, markets
• Research

Compliance jurisdiction
Essential and important entities within the sectors of high criticality and the other critical sectors listed above are under the jurisdiction of the Member State where they provide their services. If the entity provides services in more than one Member State, it should fall under each Member state's jurisdiction. Entities where the service is provided or dependent on operations outside the EU should ensure the continuity of their EU services in case of disruption of their non-EU operations.

What are your organization’s next steps (and who can help you)?
As an organization that must comply with NIS2, you need to understand your compliance and reporting obligations, and perhaps find a partner to help you on the journey. For example, you must notify the appropriate authorities, without undue delay, of any significant cyber threat that you identify that could have resulted in a significant incident.

Standardization (Article 25 of the Directive)
To promote the convergent implementation of Article 21(1) and (2), Member States shall, without imposing or discriminating in favor of the use of a particular type of technology, encourage the use of European and international standards and technical specifications relevant to the security of network and information systems.