EU NIS2 Directive: Prepare to meet the new requirements

With the NIS2 Directive, mandatory security measures and reporting obligations will apply to many companies from October 2024 – even those not previously affected.

The NIS2 Directive (Network and Information Systems 2 Directive) is a comprehensive piece of EU legislation designed to enhance cybersecurity across member states. The directive aims to strengthen the resilience of critical infrastructure and services against cyber threats and reduce the impact of security incidents.

From October 2024, it will replace the original 2016 NIS Directive, which had been the first legislation aimed at improving the cybersecurity posture of the EU. The NIS2 Directive revises and extends the previous legislation to address the rapid evolution of the threat landscape, reflecting the growing sophistication of cyberattacks and the increasing interdependencies between sectors.

NIS2 establishes common rules for cybersecurity across various sectors and introduces more robust security requirements expanding the scope of application to more critical sectors, such as energy, transport, banking, and healthcare. In particular, digital service providers and platforms are now also included in the scope of NIS2, which significantly extends the reach of the directive.

Differences between NIS2 and the first NIS Directive

Adopted in July 2016, the NIS1 Directive (Network and Information Security) was the European Union’s first legislative response to the escalating wave of cyber threats. As a groundbreaking legal instrument, its aim was to establish a common level of cybersecurity across member states’ networks and information systems. It was crafted in a context of increasing digital dependency, where the compromise of critical infrastructure could have severe consequences on security, the economy, or even public health.

NIS1 applied mainly to operators of essential services (OES) and digital service providers (DSPs). Targeted sectors included energy, transport, health, digital infrastructure, and finance.

One of NIS1’s key contributions was the creation of a cooperation framework between EU countries facilitating information-sharing and best practices and fostering coordinated and effective responses to cross-border cyber incidents.

Despite its achievements, NIS1’s implementation revealed several shortcomings:

• Member States transposed the directive with varying approaches, resulting in a lack of harmonization.
• The criteria for identifying OES were sometimes inconsistent, leading to disparate applications across countries.
• Key actors in the digital supply chain were often left outside its scope.
• Minimum sanctions were left to national discretion, thereby limiting the directive’s deterrent effect.
• The rise of new threat vectors quickly highlighted the need for a stronger legal framework.

This is where NIS2 comes in: designed to address NIS1’s limitations, it significantly expands the scope of entities concerned, introduces a more consistent approach across Member States, and enforces stricter oversight mechanisms with clearly defined sanctions. The transition from NIS1 to NIS2 marks a major step toward a more robust European cybersecurity posture, aligned with today’s digital realities.

Is your company affected by the NIS2 Directive?

Check whether you will be affected and which requirements you need to fulfil:

What are the requirements of the NIS2 Directive?

Organisations subject to the NIS2 Directive must meet several key requirements to ensure compliance:

Reporting obligations for cyber incidents: What should you report?

It’s crucial to know which cyber incidents need to be reported, to whom, and in what timeframe. For example, an initial early warning must be sent to the country-specific security authority within 24 hours of a suspected incident. If the suspicion is substantiated or confirmed, a report on the security incident must follow within 72 hours. Lastly, a final report must be sent no later than one month after notification of the confirmed incident.

The final report must include the following:

• Incident response report
• Discussion of the exploited vulnerability
• Remedial measures taken and ongoing
• Area of impact
• If the incident is not resolved within a month, organisations are required to deliver a progress report instead. In this case, the final report should follow no later than one month after the security incident has been dealt with.

As you can see, these deadlines are extremely tight. To save valuable time in the event of an incident, we recommend an annual ‘incident response emergency drill’ and a framework contract for incident response activities. This enables the response team to familiarise themselves with your systems in ‘peacetime’. It also allows you to define contact people, crisis teams and decision-makers in advance and familiarise them with important processes in the communication chain.