NIS2 Compliance

The Network & Information System (NIS2) Directive is focused on increasing cybersecurity in the European Union (EU) and helping to shape the EU’s digital future. A special focus has been put on cybersecurity incident response, with reporting obligations for significant incidents and sharing of this information between EU member states’ Cyber Security Incident Response Teams (CSIRTs) to prevent cybersecurity incidents from spreading.

NIS2 will replace the Network & Information System Directive (NIS) from May 2018, and will go into effect on 18 October 2024. EU member states must have the directive enacted into national legislation and have local supervisory and enforcement authorities established.

The European Commission has agreed on significant penalties for organisations failing to comply with the NIS2 requirements. They can receive an administrative fine of up to €10 million or 2% of the total global annual revenue for essential sectors, or €7 million or 1.4% of total global annual revenue for important sectors, and potential suspension of the organisation's top management.

The NIS2 Directive sets a general direction for the cybersecurity risk management requirements, and more detailed requirements are being developed. However, the significant effort in meeting the NIS2 requirements will be in the following areas:

• Risk assessment and security policies
• Incident handling
• Business continuity, disaster recovery, and crisis management
• Supply chain security
• Security in systems development and maintenance
• Security assessment policies and procedures
• Cyber hygiene, training, and (board) awareness
• Cryptography policies, and procedures
• Human resources security, access control, and asset management
• Reporting obligations

One of the new requirements is the board level responsibility for overseeing, approving, and monitoring cybersecurity risk management measures. The board should be trained on cybersecurity and can be held (personally) liable should the organisation fail to meet the NIS2 requirements.

An important NIS2 requirement is the reporting of significant cybersecurity incidents. The reporting timelines are challenging, as supervisory authorities need to be notified within 24 hours after becoming aware of a significant incident. Within 72 hours an incident report must be provided, followed by a final report one month afterwards. Also, customers need to be informed and provided guidance on how they should protect themselves from any threats related to the incident.