What is NIS 2?

NIS 2, short for the Directive on Measures for a High Common Level of Cybersecurity Across the Union, is the successor to the original Network and Information Systems (NIS) Directive established in 2016. As a directive, NIS 2 mandates EU member states to adapt their national laws to meet the specified cybersecurity standards, thereby ensuring a uniform level of cybersecurity preparedness and response across the EU.

Objectives of NIS 2

The primary objective of NIS 2 is to address the shortcomings of the original NIS Directive by expanding its scope, enhancing security requirements, and strengthening national cybersecurity capabilities. It aims to:

• Improve the resilience and incident response capacities of both public and private entities within critical sectors.
• Foster a culture of cybersecurity risk management, emphasizing the importance of measures proportional to the risks faced.
• Enhance cooperation among EU member states, facilitating the exchange of information and best practices in tackling cybersecurity threats.
• Ensure that entities in critical sectors adopt appropriate security measures and notify relevant national authorities of serious incidents.

Key Changes from the Previous Directive

NIS 2 introduces several significant changes and enhancements over its predecessor, including:

• Expanded Scope: NIS 2 extends its applicability to a wider range of sectors and entities, recognizing the increasing dependency on digital technologies and the potential impact of cybersecurity incidents beyond traditional critical infrastructure sectors.
• Stricter Requirements: The directive imposes stricter security and incident reporting requirements on both essential and important entities, demanding higher levels of cybersecurity hygiene and more rigorous oversight.
• Enhanced Enforcement: NIS 2 provides for increased supervisory measures, stricter enforcement requirements, and the possibility of significant penalties for non-compliance, aligning its approach more closely with the General Data Protection Regulation (GDPR).
• Focus on Supply Chain Security: Recognizing the interconnected nature of today’s digital services, NIS 2 places a particular emphasis on the security of supply chains, requiring entities to consider the cybersecurity practices of their suppliers and service providers.

Implementation Timeline

The NIS 2 Directive was adopted by the European Council and is set to be transposed into national law by the member states by a specified deadline, with the expectation of full enforcement beginning mid-October 2024. This timeline allows for the necessary legal and organizational adjustments to be made by both the member states and the entities falling under the directive’s scope.

Conclusion

The introduction of NIS 2 represents a pivotal moment in the EU’s efforts to safeguard its digital environment against the increasing threat of cyber incidents. By broadening the directive’s scope, enforcing stricter compliance requirements, and fostering a pan-European culture of cybersecurity resilience, NIS 2 aims to bolster the security of the EU’s digital single market. As the implementation deadline approaches, entities across the Union must prepare to meet the enhanced standards set forth by NIS 2, ensuring a safer and more secure digital future for all.