Ivan Spiteri
Director of Technology Advisory & Assurance
The new European directive Network and Information Security Directive 2 (NIS2) became effective in the European Union (EU) legislation on 17 October 2024. The new Directive imposes significant requirements on levelling up the cybersecurity capabilities of organisations in various sectors that are characterised as essential or important.
NIS2 enhances EU network and information systems security by requiring critical infrastructure operators to implement a minimum set of cybersecurity standards and report on cyber incidents. It expands NIS's scope, covering more organisations and industries, and its objective is to improves supply chain security, streamline reporting, and enforce stricter measures and sanctions across Europe for a safer and more secure Europe.
These mandatory, risk-based cybersecurity standards can effectively contribute to a stronger cybersecurity security posture for organisations who adopt and adhere to the standards, many of which are likely part of an established cybersecurity policy. Failure to comply with these mandatory standards may result in significant fines.
What is it for?
The NIS2 imposes security requirements that are grouped under duty of care, reporting obligation, and supervision, and are already relatively concrete before they are formalised in national legislation. These include, among others, the concrete lists of measures from Article 21 and the significant fines from Article 34 (4). Read more in the directive: EUR-Lex – 32022L2555 (europa.eu). In addition, there are a number of other notable elements such as security in the supply chain, responsibility of management bodies, and training obligations.
For whom does it apply?
Organisations that will fall under the new European directive Network and Information Security Directive 2 (NIS2) include energy companies, airlines, water companies, digital service providers, government agencies, and their suppliers. To check if your organisation falls under this directive, it is recommended that you consult information from your local government. If you have any questions, please feel free to contact us for expert advice and support.
Which type of organisations does it impact?
The NIS2 directive is aimed at more types of companies and organisations than the first NIS directive. This means that there are now more public and private organisations that must comply with the rules.
The organisations now covered by the NIS2 directive include:
