Network and Information Security Directive (NIS2)

The NIS2 Directive (Directive 2022/2555) is the EU's updated cybersecurity framework, adopted on 14 December 2022 with a transposition deadline of 17 October 2024 for EU member states. It replaces the original NIS Directive (2016/1148) and significantly broadens its scope and enforcement mechanisms.

NIS2 categorises entities as either "essential" or "important" based on sector and size. Essential entities include energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management (B2B), public administration, and space. Important entities cover postal services, waste management, chemicals, food production, manufacturing, digital providers, and research.

The directive applies to medium and large enterprises in these sectors (50+ employees or €10M+ turnover), though member states may extend it to smaller entities in critical roles. Supply chain security receives particular emphasis, requiring entities to assess and manage risks from direct suppliers and service providers.

Organisations must implement "appropriate and proportionate" cybersecurity risk-management measures covering at least: risk analysis and information system security policies; incident handling; business continuity and crisis management; supply chain security; security in network and information system acquisition, development, and maintenance; vulnerability handling and disclosure; cybersecurity testing; use of cryptography and encryption; human resources security; and access control and asset management.

Significant incidents must be reported to the national CSIRT or competent authority within defined timeframes: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month. The directive introduces personal liability for management bodies, who must approve cybersecurity measures, oversee their implementation, and undergo cybersecurity training.

Member states must designate national competent authorities, establish CSIRTs, and participate in the EU Cyber Crisis Liaison Organisation Network (CyCLONe) for coordinated incident response. The European Union Agency for Cybersecurity (ENISA) plays a central support and coordination role.