In response to the increasing threat of cybersecurity attacks targeting critical industries and essential infrastructure, the EU has introduced the new Network and Information Systems Directive (NIS2). This directive aims to elevate cybersecurity standards across the EU and must be implemented by Member States by October 17, 2024.
NIS2 builds upon the foundation laid by its predecessor, NIS1, which was established in 2016. The updated directive expands the scope of cybersecurity regulations to include new industries such as medical devices, pharmaceuticals, and wholesale food businesses.
Key features of NIS2 include a wider reach, with online marketplaces, food production, and certain manufacturers now falling under its purview. Organizations regulated under NIS2 will be categorized as ‘Essential’ or ‘Important’ based on various factors.
Additionally, NIS2 introduces notification obligations for cybersecurity incidents with significant impacts, as well as requirements for entities to implement cybersecurity risk management measures. Non-compliance with NIS2 can result in hefty fines and penalties, with senior management potentially facing personal liability.
With Member States required to transpose NIS2 by 2024, organizations are urged to assess their obligations and develop compliance plans to avoid sanctions. For more information and expert advice on navigating these new cybersecurity rules, contact our Privacy & Data Security team.