Key Points
- The NIS2 directive is the EU’s updated cybersecurity law requiring risk management, incident response, and reporting from organizations across 18 critical sectors.
- NIS2 compliance is required from organizations classified as Essential or Important Entities based on factors such as their sector, size, and criticality.
- NIS2 incident reporting follows a strict timeline: a 24-hour early warning, a 72-hour incident notification, and a final report within one month.
- NIS2 requires organizations to address supply chains security risks, including risks associated with their direct suppliers and service providers.
- NIS2 calls for cooperation between EU member states, mandating that competent authorities and national CSIRTs share information and best practices.
- Preparing for NIS2 compliance entails cybersecurity gap analysis, risk management planning, staff training, ongoing vulnerability management, and incident reporting.
To better protect its residents, organizations, and institutions, the European Union (EU) has strengthened its stance on cybersecurity with the introduction of NIS2, the newly upgraded Network and Information Security directive. This legislative framework is a response to the evolving cyber threats that show no sign of abating.
In this article, we demystify NIS2 and share how it’s being used to establish a strong, unified cybersecurity framework across the EU.
What is NIS2?
NIS2 is an updated version of the original Network and Information Security directive, tailored to meet the shifting challenges in cybersecurity. Its redesign reflects the European Union’s commitment to bolstering the resilience of critical infrastructure and digital services in the face of modern cyber threats.
This update outlines additional requirements and responsibilities for organizations in specific sectors deemed vital to the functioning of society and the economy. These sectors form an integral part of the NIS2 directive’s comprehensive strategy to address cyber risks and networks and information systems.
Watch the What Is NIS2? video for a simple breakdown of the basics.
Purpose of the NIS2 directive
As cyber-attacks become more common and sophisticated, the EU is encouraging businesses to elevate their cybersecurity. The NIS2 directive seeks to create a shared cybersecurity playbook for the EU. In doing so, the EU hopes to promote cooperation and information between member states to keep data secure.
Requirements of NIS2
The NIS2 directive imposes several requirements on organizations:
- Implementing appropriate security measures
- Establishing incident response plans
- Conducting regular risk assessments
- Ensuring the confidentiality, integrity, and availability of networks and information systems
Sectors that must comply with NIS2
NIS2 rules extend across 18 sectors grouped into two annexes:
- Annex I includes the higher-criticality sectors: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, and space.
- Annex II comprises the other critical sectors: postal and courier services, waste management, chemicals, food, manufacturing, digital providers such as online marketplaces and search engines, and research organizations.
As these sectors are critical to society and the economy, any disruptions in their networks and information systems could lead to serious problems. NIS2 is a formal way of ensuring stability and security in these essential areas.
Understanding the NIS2 directive
Effectively navigating the regulatory landscape requires comprehending the extensive reach of the NIS2 directive as it encompasses both public and private entities across a wide range of critical sectors within the EU.
Learn how you can turn NIS2 guidance into effective workflows in your operations
Scope and applicability of the NIS2 directive
The scope of the NIS2 directive is wide-reaching, applying to both public and private entities across a broad range of critical sectors in the EU. These rules also apply to organizations in the digital realm, including online marketplaces, search engines, and cloud services.
Key obligations under the NIS2 Directive
According to the NIS2 directive, organizations must adopt suitable and reasonable technical and organizational measures to handle the risks to their networks and information systems:
- Risk management: Entities must conduct risk assessments and implement measures to manage and secure their network and information systems.
- Incident reporting: Organizations must report significant incidents to their competent authority or national CSIRT on a strict timeline:, an early warning within 24 hours of becoming aware of an incident, a fuller incident notification within 72 hours, and a final report within one month of the incident notification.
- Cooperation and information sharing: Collaboration between member states and competent authorities is mandated, fostering a proactive approach to cybersecurity through the exchange of information and best practices.
- Security measures for digital service providers: Digital service providers that fall within the scope of NIS2 must implement appropriate cybersecurity risk-management measures.
- Security requirements for covered entities: Operators within the scope of NIS2 must adhere to specific security requirements to protect their network, information systems, and services.
- Incident response plans: Entities are obligated to establish and maintain incident response plans outlining procedures to be followed in the event of a cybersecurity incident.
- Audit and certification: Certain entities may be subject to audits and other supervisory measures to verify compliance with the NIS2 directive.
Enforcement mechanisms
To achieve NIS2 directive compliance, member states must appoint competent national authorities tasked with overseeing and enforcing the directive. These authorities hold the authority to perform audits, inspections, and investigations, as well as to levy sanctions and penalties for non-compliance. The directive also encourages collaboration and the exchange of information among member states to streamline the prevention and detection of (and response to) cyber incidents.
Penalties
Failure to comply with the NIS2 directive can lead to substantial penalties:.
- Essential Entities face administrative fines of up to €10 million or 2 percent of total global annual turnover, whichever is higher.
- Important Entities may face administrative fines of at least €7 million or 1.4 percent of total global annual turnover, whichever is higher.
Individual member states can set requirements above these minimums, and management bodies can, in some cases, be held personally accountable for noncompliance.
Starting the journey to compliance
By following these steps and adopting a proactive approach to cybersecurity, your organization can navigate the regulatory landscape with confidence and implement effective measures to meet the requirements of NIS2 compliance.
Complete a gap analysis
Ensuring adherence to the NIS2 directive begins with conducting a thorough gap analysis. This entails evaluating existing cybersecurity measures in comparison to the directive’s requirements and pinpointing any areas of non-compliance or vulnerabilities. The insights gained from the gap analysis are invaluable, shedding light on the organization’s current security stance and aiding in prioritizing efforts for remediation.
Implement training and process changes
After identifying the gaps, organizations should conduct suitable training programs and process adjustments to tackle the deficiencies. This might include
- offering cybersecurity awareness training to employees,
- updating security policies and procedures, and
- incorporating secure coding practices.
Consistent training and awareness initiatives will foster a cybersecurity culture within the organization so employees are well-prepared to recognize and respond to potential threats.
Invest in appropriate security measures
Organizations can make their networks and information systems more secure and resilient by implementing security measures, such as multi-factor authentication, where appropriate. These measures can help organizations manage cybersecurity risks and support NIS2 compliance.
Set up rigorous reporting
Compliance with the NIS2 directive requires organizations to establish reporting mechanisms. This includes implementing systems to monitor and report cybersecurity incidents, conducting regular vulnerability assessments, and sharing information with competent authorities and other relevant stakeholders. Setting up rigorous reporting processes will ensure timely detection and response to cyber incidents, facilitating collaboration and information sharing between organizations and authorities.
Watch The Requirements of NIS2 Compliance: An Overview, which highlights the directive’s requirements, essential security measures, compliance checklists, and best practices for long-term resilience.
Manage risk, strengthen operational resilience, and maintain NIS2 compliance with effective vulnerability management
Manage compliance with the help of NinjaOne
NinjaOne provides comprehensive endpoint management capabilities that can support an organization’s cybersecurity and compliance effort. With features like remote monitoring and management, vulnerability management, automated patch management, and reporting, NinjaOne helps organizations maintain visibility and address security risks across managed endpoints.
For organizations subject to directives like NIS2, NinjaOne can support cybersecurity risk-management efforts across on-site and remote work environments. Whether it’s monitoring vulnerabilities, automating patching, or providing reporting and visibility into endpoint health NinjaOne helps organizations implement and maintain important security measures.
Learn more about enterprise IT security tools from NinjaOne.
