Introduction to NIS2
The Network and Information Security Directive 2 (NIS2) is the EU's updated cybersecurity legislation that significantly expands scope and strengthens requirements for entities operating critical infrastructure.
NIS2 Overview
Key Changes from NIS1:
Expanded sector coverage
Stricter requirements
Harmonized penalties
Management accountability
Supply chain focus
Timeline
Key Dates:
January 2023: Entered into force
October 2024: Member state transposition deadline
2025: Enforcement begins
Scope and Applicability
Essential Entities
Sectors:
Energy (electricity, oil, gas, hydrogen)
Transport (air, rail, water, road)
Banking and financial markets
Health sector
Drinking and waste water
Digital infrastructure
ICT service management
Public administration
Space
Important Entities
Sectors:
Postal and courier services
Waste management
Chemical manufacturing
Food production
Manufacturing (medical, electronics, machinery)
Digital providers
Research organizations
Size Thresholds
Large Enterprises:
250+ employees OR
€50M+ turnover AND €43M+ balance sheet
Medium Enterprises:
50+ employees OR
€10M+ turnover
Cybersecurity Requirements
Risk Management Measures
Required Measures:
Risk analysis and policies
Incident handling
Business continuity
Supply chain security
Network and systems security
Vulnerability management
Cyber hygiene and training
Cryptography and encryption
Access control
Multi-factor authentication
Governance Requirements
Management Accountability:
Management body approval of measures
Mandatory cybersecurity training
Personal liability for non-compliance
Oversight of implementation
Supply Chain Security
Requirements:
Supplier risk assessment
Security requirements in contracts
Vulnerability management
Continuous monitoring
Incident Reporting
Reporting Obligations
Significant Incidents:
Cause/could cause severe disruption
Affect other member states
Impact essential services
Reporting Timeline
Early Warning:
Within 24 hours of awareness
Initial indication of incident
Incident Notification:
Within 72 hours
Initial assessment
Severity and impact
Final Report:
Within one month
Root cause analysis
Remediation measures
Competent Authorities
Reporting To:
National CSIRT
Competent authority
Cross-border notification if applicable
Penalties and Enforcement
Penalty Framework
Essential Entities:
Up to €10 million OR
2% of global annual turnover
Whichever is higher
Important Entities:
Up to €7 million OR
1.4% of global annual turnover
Whichever is higher
Management Liability
Personal Consequences:
Held personally liable
Temporary prohibition from management
Public naming and shaming possible
Enforcement Powers
Authority Powers:
On-site inspections
Security audits
Information requests
Binding instructions
Administrative fines
Implementation Roadmap
Phase 1: Assessment (Q1)
Scope determination
Gap analysis
Risk assessment
Roadmap development
Phase 2: Foundation (Q2)
Governance structure
Policy framework
Incident response plan
Training program
Phase 3: Technical (Q3-Q4)
Security controls
Monitoring capabilities
Supply chain program
Testing and validation
Phase 4: Compliance (Ongoing)
Audit preparation
Continuous improvement
Regulatory engagement
Documentation
Key Requirements Breakdown
Risk Analysis and Policies
Components:
Information security policy
Risk assessment methodology
Risk treatment plans
Regular reviews
Incident Handling
Capabilities:
Detection mechanisms
Response procedures
Communication protocols
Recovery plans
Business Continuity
Requirements:
Business impact analysis
Continuity plans
Disaster recovery
Regular testing
Access Control and Authentication
Requirements:
Role-based access
Multi-factor authentication
Privileged access management
Regular access reviews
Relationship with Other Frameworks
GDPR Alignment
Overlaps:
Security measures
Incident notification
Risk assessment
Documentation
Sector-Specific Regulations
Considerations:
DORA for financial sector
Energy sector regulations
Telecoms framework
Health sector rules
International Standards
Alignment:
ISO 27001 mapping
NIST CSF alignment
Industry best practices
CIS Controls
Practical Steps
Immediate Actions
Priority Tasks:
1Determine if in scope
2Identify competent authority
3Gap assessment
4Budget allocation
Quick Wins
Easy Improvements:
Policy documentation
MFA deployment
Incident response plan
Staff training
Conclusion
NIS2 represents a significant expansion of EU cybersecurity requirements. Organizations must assess applicability, implement comprehensive security measures, and prepare for stringent incident reporting to achieve compliance.