The European Union's Network and Information Security Directive 2 (NIS2) is an updated legislative act aimed at achieving a high common level of cybersecurity across the European Union. Originally adopted in 2016, the first iteration of NIS relied heavily on the discretion of individual member states and lacked accountability.
On January 16, 2023, in response to growing threats posed by increasing digitalization and the surge in cyber-attacks, the EU adopted NIS2 to strengthen security requirements and cyber resilience. The EU's 27 Member States have until October 17, 2024, to transpose the NIS2 Directive into applicable, national laws.
NIS2 requires operators of critical infrastructure and essential services in the EU to implement appropriate security measures and report any incident to the relevant authorities. The Directive addresses the security of supply chains, streamlines reporting obligations, and introduces more stringent supervisory measures and stricter enforcement requirements, including harmonized sanctions across the EU.
NIS2 expands the original NIS Directive to cover more industry sectors, with additional risk-management measures and incident reporting obligations. It also provides for stronger enforcement. NIS2 adds to NIS in 4 key areas:
NIS2 has expanded the directive's scope from seven sectors to eighteen. The major difference between these two categorizations is how the entities are supervised.
Individual member states can determine what constitutes supervision, such as:
"Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational, and organizational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or the provision of their services and to prevent or minimize the impact of incidents on recipients of their services and on other services."
Article 23 of NIS2 requires that every significant cybersecurity incident "…that has a significant impact on the provision of their services…" be reported, whether or not the attack actually affected the entity's operations. The purpose of this is to help authorities improve monitoring and responses to potential threats. NIS2 maintains the requirement from NIS that every EU member state designates a central point of contact for compliance and a coordinating Computer Security Incident Response Team (CSIRT) for incident reporting or a competent authority.
The most significant change around incident reporting is how the NIS2 Directive details the mandatory multi-stage incident reporting process and the content that must be included:
- Material operational disruption or financial losses for the entity concerned.
- It may affect natural or legal persons by causing significant material or immaterial damage.
Failure to comply with the NIS2 Directive comes with stricter penalties than NIS. Under the NIS2 Directive, penalties for non-compliance differ for essential entities and important entities.
Rather than put all the pressure of NIS 2 compliance on IT departments, the Directive includes new sanctions to hold top management bodies personally liable for gross negligence in the event of a cybersecurity incident. For example, a competent authority can temporarily ban executives from holding management positions. It can also order organizations to disclose compliance violations and make a public statement identifying the person(s) responsible for the incident.
The NIS2 Directive came into effect in January 2023. EU Member States have until October 17, 2024, to incorporate its provisions into their national laws and establish criteria for categorizing entities.
After publishing the categorization criteria, member states must create a list of all entities covered by the directive and notify them promptly. Upon receiving categorization notification, essential or important entities must implement all requirements within the timeframe specified in national laws.
Alongside NIS2, EU operators will have to contend with numerous other regulations, including:
NIS2 vs DORA: Both are cybersecurity regulations, but DORA is specifically focused on the financial sector, whereas NIS2 covers a broader range of organizations. For financial entities, DORA's provisions related to ICT risk management and reporting, digital operational resilience testing, information sharing, and third-party risk shall apply instead of those outlined in NIS2.
NIS2 vs. the CER Directive: The CER Directive applies to critical entities, guiding their defenses against non-cyber-related risks. While NIS2 focuses on cybersecurity, there may be overlaps in terms of the entities covered. In such cases, organizations will need to ensure compliance with both directives, addressing both cyber and physical resilience.
NIS2 vs. CRA: The Cyber Resilience Act focuses on the cybersecurity of hardware and software products with digital elements. Where NIS2 focuses on enhancing the security posture of companies themselves, the CRA requires companies to prioritize the security of the products they manufacture or sell. Generally, the CRA complements NIS2 but doesn't necessarily overlap or supersede it.
Alfatec Group boasts a long-standing presence in the industry. Our enduring collaborations with numerous vendors span several decades, highlighting our commitment and expertise. Among our most valued partnerships are those with Thales and Entrust, relationships that consistently deliver exceptional value to our diverse clientele.
As awarded distributors for the SEE region, we offer a comprehensive suite of services:
These partnerships empower us to provide cutting-edge solutions and unparalleled support, reinforcing our position as a trusted partner.
"At Entrust, we take the pain out of cybersecurity and data protection." Their portfolio includes all the compliance solutions you need, including:
Entrust KeyControl provides precise control over your cryptographic keys and secrets, offering complete visibility, traceability, and an immutable audit trail.
Entrust's nShield HSMs provide a secure environment for generating, managing, and protecting cryptographic keys, which are essential for securing sensitive data and ensuring the integrity of digital transactions.
Entrust provides IAM solutions that enable organizations to ensure only authorized users can access sensitive information, providing a firm foundation for Zero Trust security.
THALES
Thales CipherTrust Manager enables compliance with the NIS2 regulation by covering a wide range of requirements:
NIS2 expands to cover more industry sectors, with additional risk-management measures and incident reporting obligations, providing stronger enforcement. NIS2 adds to NIS in 4 key areas:
NIS2 has expanded from 7 sectors to 18. The major difference between categorizations is how the entities are supervised.
Individual member states can determine what constitutes supervision, such as:
Essential entities must comply with supervision requirements.
Important entities will only be subject to ex-post supervision; action will be taken only if authorities receive evidence of non-compliance.
The new NIS2 Directive bolsters cyber resilience by introducing obligations across four areas:
"Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational, and organizational measures to manage the risks posed to the security of network and information systems which those entities use for their operations or the provision of their services and to prevent or minimize the impact of incidents on recipients of their services and on other services."
The most significant change around incident reporting is how the NIS2 Directive details the mandatory multi-stage incident reporting process and the content that must be included:
Failure to comply with the NIS2 Directive comes with stricter penalties than NIS. Under the NIS2 Directive, penalties for non-compliance differ for essential entities and important entities.
The NIS2 Directive came into effect in January 2023. EU Member States have until October 17, 2024, to incorporate its provisions into their national laws and establish criteria for categorizing entities.
After publishing the categorization criteria, member states must create a list of all entities covered by the directive and notify them promptly. Upon receiving categorization notification, essential or important entities must implement all requirements within the timeframe specified in national laws.
Alongside NIS2, EU operators will have to contend with numerous other regulations, including:
Both are cybersecurity regulations, but DORA is specifically focused on the financial sector, whereas NIS2 covers a broader range of organizations. For financial entities, DORA's provisions related to ICT risk management and reporting, digital operational resilience testing, information sharing, and third-party risk shall apply instead of those outlined in NIS2.
The CER Directive applies to critical entities, guiding their defenses against non-cyber-related risks. While NIS2 focuses on cybersecurity, there may be overlaps in terms of the entities covered. In such cases, organizations will need to ensure compliance with both directives, addressing both cyber and physical resilience.
The Cyber Resilience Act focuses on the cybersecurity of hardware and software products with digital elements. Where NIS2 focuses on enhancing the security posture of companies themselves, the CRA requires companies to prioritize the security of the products they manufacture or sell. Generally, the CRA complements NIS2 but doesn't necessarily overlap or supersede it.
As awarded distributors for the SEE region, we offer a comprehensive suite of services:
"At Entrust, we take the pain out of cybersecurity and data protection." Their portfolio includes all the compliance solutions you need, including:
Thales CipherTrust Manager enables compliance with the NIS2 regulation by covering a wide range of requirements:
The NIS2 directive dramatically raises the bar for cyber risk management and incident reporting obligations across the EU for the majority of public or private organizations. Its strict reporting requirements ensure no covered organization can ignore it without risking major penalties. Even organizations not considered "essential", such as manufacturers and online portals can be subject to targeted audits, on-site inspections, requests for information, and random checks.
Organizations will need to implement comprehensive cybersecurity measures, including application security, data protection, and identity management, to comply with NIS2 and other overlapping regulatory regimes. As the compliance landscape becomes increasingly complex, businesses may benefit from partnering with cybersecurity solution providers to ensure they meet all necessary requirements and maintain robust cyber resilience.
To make this website run properly and to improve your experience, we use cookies. For more detailed information, please check our Cookie Policy.
Necessary cookies enable core functionality. The website cannot function properly without these cookies, and can only be disabled by changing your browser preferences.
