In response to the increasing threat of cybersecurity attacks targeting critical industries and essential infrastructure, the EU has introduced the new Network and Information Systems Directive (NIS2). This directive aims to enhance cybersecurity standards across the EU and must be implemented by Member States by October 17, 2024.
NIS2 builds upon the previous NIS Directive (NIS1) from 2016 by expanding the scope of cybersecurity regulations to include new industries such as medical devices, pharmaceuticals, R&D of medicinal products, and wholesale food businesses. The goal is to establish a high common level of cybersecurity throughout the EU.
Key points of NIS2 include:
- Increased scope: NIS2 now covers not only critical infrastructure sectors like energy and transportation but also online marketplaces, food production, and certain manufacturers.
- Notification obligations: Entities must report cybersecurity incidents with a significant impact on their services to the relevant authorities.
- Cybersecurity risk management measures: Essential and important entities must implement security measures to manage risks and prevent incidents.
- Supervision: Essential and important entities will face increased supervision, including audits and inspections.
- Fines and enforcement: Non-compliance with NIS2 can result in significant fines for essential and important entities.
- Leadership accountability: Senior management can be held liable for failing to implement cybersecurity measures.
With the deadline for transposing NIS2 approaching, organisations should assess their obligations and develop a compliance plan to avoid potential sanctions. For more information and expert advice, contact our Privacy & Data Security team.
People also ask
|
What is NIS2? |
|
The NIS2 Directive is the EU-wide legislation on cybersecurity. It provides legal measures to boost the overall level of cybersecurity in the EU. NIS2 essentially functions as an update to the previous NIS Directive (NIS1) which was implemented in 2016. The updates include broadening the scope of cybersecurity regulations to include new industries and organisations that were not previously captured by NIS1. |
|
What organisations are affected by NIS2? |
|
NIS2 casts a wider net than NIS1 encompassing not just critical infrastructure providers like energy and transportation, but also important sectors like online marketplaces, food production, and certain manufacturers. Entities regulated under NIS2 are categorised as ‘Essential’ or ‘Important’ depending on factors such as size, industry sector and criticality. |
|
When does NIS2 come into force? |
|
The deadline for EU Member States to transpose NIS2 into their national laws is 17 October 2024. This means each Member State needs to adapt their own legal systems to reflect the requirements of NIS2. After this date, businesses within those Member States will be subject to national enforcement of NIS2. |
The content of this article is provided for information purposes only and does not constitute legal or other advice.