The EU’s NIS2 Directive: key points you need to know

NIS1 distinguished between “operators of essential services” and “digital service providers”. NIS2 on the other hand classifies in-scope organisations based on their importance to society and the economy and divides them into “essential” and “important” entities.

NIS2 applies to essential and important entities that: (i) are established in a Member State; and/or (ii) are based outside the EU but provide services within a Member State.

“Essential entities”: entities with approximately 250 employees and an annual turnover of €50 million or balance sheet of €43 million, operating in the following sectors:

• Energy (electricity, oil, gas, district heating and hydrogen)
• Transport (air, rail, water and road transportation)
• Finance (banking and financial market infrastructure)
• Public administration (including social services, public safety, economic regulation and political representation)
• Health (public and private healthcare providers, medical equipment and medicine manufacturers, medical insurance providers and other critical health-related services)
• Space
• Water supply (drinking and wastewater)
• Digital infrastructure (Telecom, DNS, TLD, data centres, trust services, ICT management and cloud services)
• Any of the above sectors which reach the “important” entity size threshold outlined below.

Important entities: entities with approximately 50 employees, annual turnover of €10 million or balance sheet of €10 million, operating in the following sectors:

• Postal services (postal and courier services)
• Waste management (for maintaining public health, environmental protection and sustainability)
• Chemicals
• Research
• Foods
• Manufacturing (of medical devices, computers and electronics, machinery and equipment, motor vehicles, trailers, semi-trailers and other transportation equipment)
• Digital service providers (if using, providing or relying on the broad range of digital services including search engines, online markets, and social networks)

Certain entities may be covered by NIS2 even if they do not meet the above size criteria. For example, if the entity fulfils criteria that indicate it plays a key role for the economy, society or particular sectors and services. Further guidelines on the implementation of these criteria are due to be issued by the European Commission.

The European Commission introduced NIS2 to harmonise security requirements across Member States. This was deemed necessary as some Member States implemented NIS1’s security and incident reporting requirements in significantly different ways, creating an additional burden for businesses operating in more than one Member State. Under NIS2, all relevant entities must ensure that they implement the following (as part of the technical, operational and organisational measures they take to manage cybersecurity risks):

1. Policies on risk analysis and information system security.
2. Processes in respect of incident handling.
3. Processes in respect of business continuity, such as backup management, disaster recovery, and crisis management.
4. Processes in respect of supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers.
5. Processes in respect of security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure.
6. Policies and procedures to assess the effectiveness of cybersecurity risk-management measures.
7. Basic cyber hygiene practices and cybersecurity training.
8. Policies and procedures regarding the use of cryptography and, where appropriate, encryption.
9. Processes in respect of human resources security, access control policies and asset management.
10. The use of multi-factor authentication or continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems within the entity, where appropriate.

Your organisation may already have stringent information and cybersecurity measures in place. However, you should assess whether those measures meet the minimum requirements set out above and, if not, what steps you need to take in order to comply with such requirements (for example, reviewing your policies and procedures or updating your business continuity plan).

The European Commission also plans to specify the technical and methodological requirements of the measures set out above with regard to certain essential and important entities including, but not limited to, cloud computing service providers and managed service providers by 17^th October 2024.

NIS2 introduces more robust standards for security requirements in your supply chain security. If your business is affected by NIS2, you are required to carry out due diligence on your suppliers’ cybersecurity practices to mitigate the risk of security breaches in your supply chain. You also have to ensure that any technical, operational and organisational measures you take to manage supply chain security risks take into account the vulnerabilities of each supplier, their quality and the cybersecurity practices of the suppliers’ service providers.

NIS2 sets out specific penalties for non-compliance which include non-monetary penalties (such as compliance orders), administrative fines and criminal sanctions. Non-compliance fines for essential entities can reach up to 2% of total worldwide annual turnover or €10 million (whichever is higher) whilst fines for important entities can be up to 1.4% of total worldwide annual turnover or €7 million.

Depending on the size of your organisation, these penalties could have a significant financial impact. They also carry the risk of serious reputational damage. If you are an organisation within NIS2’s scope then developing an internal compliance framework will be key to mitigating these risks.

Security incidents that affect the provision or receipt of services by a relevant entity will have to be reported more stringently under NIS2. As part of this, you must notify the relevant competent authority within 24 hours of becoming aware of the incident, submit a final incident report within one month following discovery and inform recipients of services impacted.

You will need to think about how to ensure you can meet these reporting obligations if your organisation falls within NIS2’s scope. To enable your business to be able to recognise and report a potential cybersecurity threat or incident, you will likely need to provide adequate training and guidance, in the form of policies and procedures.