Summary
The NIS2 Directive (Network and Information Security Directive 2) is an EU regulation that mandates minimum cybersecurity standards across critical and important sectors, affecting significantly more organizations than the original NIS1 directive.
What is the NIS2 Directive?
NIS2 is the revised EU directive on network and information security. It entered into force in January 2023 and must be transposed into national law by EU member states. The directive substantially expands the circle of affected organizations and tightens requirements for risk management, incident reporting, and governance.
Organizations with 50 or more employees or €10 million or more in annual revenue operating in 18 defined sectors are affected. These sectors include energy, transport, healthcare, digital infrastructure, and ICT service management.
Key obligations include 24-hour incident reporting windows, supply chain security assessments, and personal liability for executive management in the event of non-compliance.
Why is the NIS2 Directive relevant?
- Expanded scope: Far more organizations are covered compared to NIS1
- Personal liability: Executive management can be held personally liable
- Incident reporting: Security incidents must be reported within 24 hours
- Supply chain security: Organizations must assess the security of their supply chains
- Penalties: Up to €10 million or 2% of global annual turnover