NIS2

What is NIS2?

NIS2 is the EU’s main horizontal cybersecurity law. It replaced the 2016 NIS Directive with a much wider scope, stricter duties and real accountability for management. Because it is a directive, organisations must comply with the national law of each member state that transposes it, so details such as registration and authority contacts vary by country.

Who does it apply to?

NIS2 covers medium-sized and large organisations in sectors of high criticality, such as energy, transport, banking, financial market infrastructure, health, drinking and waste water, digital infrastructure, ICT service management, public administration and space. It also covers other critical sectors, such as postal services, waste management, chemicals, food, manufacturing of key products, digital providers and research. Entities are classed as essential or important. Both have the same core duties, but essential entities face proactive supervision and higher fines. Some entities, such as DNS and top-level domain providers, are covered regardless of size.

Key duties

• Governance: management bodies must approve the cybersecurity risk-management measures, oversee them and take training. They can be held liable for failures.
• Risk-management measures (Article 21): an all-hazards approach covering, at a minimum, risk analysis and policies, incident handling, business continuity and crisis management, supply-chain security, secure development and vulnerability handling, effectiveness testing, cyber hygiene and training, cryptography, access control and asset management, and multi-factor authentication where appropriate.
• Incident reporting (Article 23): for significant incidents, an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.

How does it relate to other frameworks?

ISO/IEC 27001 and NIST CSF 2.0 map well onto the Article 21 measures. For financial entities, DORA applies as the sector-specific law.