NIS2

NIS2
Name	NIS2
Type	Directive
Adopted	2022
Jurisdiction	European Union
Related	Directive on security of network and information systems (NIS Directive)

NIS2

NIS2 is a European Union Directive updating the NIS Directive to strengthen cybersecurity resilience across European Union member states including France, Germany, Italy, Spain, Poland and Netherlands. It aims to harmonize rules among institutions such as the European Commission, European Parliament, European Council, European Union Agency for Cybersecurity and national authorities including ENISA and various national cybersecurity agencies. The legislative package interacts with instruments like the General Data Protection Regulation, Digital Services Act, Cybersecurity Act and sectoral laws such as the Network and Information Security Directive predecessors and national frameworks in Belgium and Sweden.

Background and purpose

The directive emerged after major incidents involving entities in SolarWinds, Colonial Pipeline, Maersk and NotPetya that highlighted gaps noted by bodies such as the European Court of Auditors, Council of the European Union and advisory groups including the High Level Group on Cybersecurity. It responds to recommendations from reports by ENISA, academic centers like the Oxford Internet Institute and industry groups including European Telecommunications Network Operators' Association and ISACA. The purpose is to enhance incident reporting seen in cases investigated by agencies like CERT-EU, CISA and national Computer Security Incident Response Teams such as CERT-FR and GovCERT.ch, and to align member state measures with precedents from NATO cooperative cybersecurity exercises and standards influence from bodies like ISO/IEC.

Scope and obligations

The directive expands scope to cover essential and important entities across sectors including operators in energy, transport, healthcare, banking, financial services, drinking water supply and distribution, digital infrastructure, space industry and public administration at specific levels. Obligations apply to organizations such as Deutsche Bank, BNP Paribas, Santander Group, Siemens, Airbus, Maersk logistics units and cloud providers like Amazon Web Services, Microsoft Azure, Google Cloud. Entities must interact with national competent authorities such as ANSSI and Bundesamt für Sicherheit in der Informationstechnik and cooperate with Computer Security Incident Response Teams like CERT-UK and CSIRT-CY. Thresholds reflect precedents from directives affecting Telecom Italia, Vodafone Group, Telefonica and critical infrastructure operators referenced in international agreements like the Budapest Convention on Cybercrime.

Key cybersecurity requirements

Mandated measures include risk management practices drawn from standards such as ISO/IEC 27001, NIST Cybersecurity Framework, IEC 62443 and techniques used by companies such as KPMG, Deloitte, Accenture in advisory roles. Requirements cover incident detection, logging, multi-factor authentication seen in implementations by Google and Facebook (Meta Platforms), encryption practices promoted by Let's Encrypt and supply chain security following guidance by OWASP and ENISA. Reporting obligations echo timelines used by CISA and reporting templates informed by FIRST and ETSI technical committees. Governance requirements reference board-level responsibilities similar to those enforced in cases involving Barclays, HSBC, ING Group and corporate risk frameworks used by BP and Shell plc.

Governance and enforcement

Enforcement powers reside with national authorities analogous to regulators such as Autorité de la concurrence, Bundesnetzagentur, CNIL, Agencia Española de Protección de Datos and enforcement examples mirror actions by European Commission competition and regulatory units. Sanctions can resemble fines applied under General Data Protection Regulation precedents and follow administrative procedures seen in cases before the Court of Justice of the European Union. Cooperation mechanisms invoke networks like CERT-EU, ENISA and bilateral agreements with agencies such as CISA and institutions including OECD cybersecurity initiatives. Oversight includes reporting to bodies such as the European Parliament committees and ad hoc groups like the European Cybercrime Centre.

Implementation and compliance timeline

Member states were tasked with transposition deadlines that align with legislative timetables discussed in sessions of the European Council and votes in the European Parliament plenary, with staggered compliance phases reflecting implementation plans similar to those used for the Markets in Financial Instruments Directive II and the Payment Services Directive 2. Deadlines affect large entities first, then medium and small undertakings, mirroring staged rollouts used in MiFID II and PSD2. National supervisory authorities provide guidance and adoption plans similar to implementation strategies published by ENISA, CNIL and BfDI and coordinate technical assistance with organizations like CERT-EU and ETSI.

Impact on sectors and supply chains

Sectors such as aviation, maritime transport, pharmaceutical industry, energy sector and banking face heightened obligations that cascade to suppliers including system integrators like Capgemini and T-Systems, hardware vendors such as Cisco Systems, Huawei Technologies, Ericsson and software providers like SAP SE and Oracle Corporation. Supply chain rules drive changes in procurement practices used by multinational purchasers such as European Investment Bank, International Monetary Fund and corporations with complex vendor ecosystems like Volkswagen Group and Renault. The directive influences certification schemes similar to those produced by ISO, ETSI and national standards bodies like DIN and AFNOR, and is expected to alter insurance markets involving firms like AIG (company), Lloyd's of London and Munich Re that underwrite cyber risk.

Category:European Union law