The NIS 2 Directive (EU 2022/2555) is a set of EU regulations aimed at significantly raising the level of cybersecurity in organisations critical to the functioning of the economy and society. It replaces the previous NIS Directive, expanding both the scope of entities covered by the regulation and the list of obligations.

NIS 2 introduces uniform standards for information security management and cyber incident response across all EU Member States.

Who is affected by NIS 2?

The Directive covers a much wider range of organisations than before, including, amongst others:

• energy, transport, banking and financial infrastructure,
• healthcare and pharmaceuticals,
• digital and IT service providers,
• telecommunications, water supply and waste management,
• industrial manufacturing, logistics and the food sector.

It is not only the sector that is key, but also the size of the organisation and its role in supply chains.

Key obligations under NIS 2

Organisations covered by NIS 2 must implement, among other things:

• a systematic approach to cybersecurity risk management,
• appropriate technical and organisational measures,
• incident response and business continuity procedures,
• an obligation to report incidents within strictly defined timeframes,
• management oversight of cybersecurity (accountability of senior management).

The Directive places strong emphasis on management responsibility and the effective enforceability of the provisions.

Penalties for non-compliance

Failure to comply with the NIS 2 requirements may result in:

• heavy financial penalties,
• administrative sanctions,
• personal liability of senior management,
• loss of trust among customers and business partners.