What is NIS2, and how will it make your organization more secure?

The Network and Information Systems is the full name of the NIS2 directive.
We recommend further reading on the Official Journal of the European Union for a full view of the new regulation.

October 17, 2024, is the date you need to remember and work towards. That is when EU member states must adopt and publish their local legislation of the NIS2 directive.

By April 17, 2025, each member state must have identified essential and important entities within their own country.

NIS came into effect in July 2016 and was meant to improve cyber resilience within the European Union. However, the regulations were more in line with recommendations than imposed laws. 

That is the most significant difference with NIS2, apart from a broader scope, with more industries included and higher requirements. Not complying with NIS2 for organizations deemed essential or important will result in severe fines or even suspension of business.

The original NIS directive set out to improve cybersecurity throughout the European Union. However, geopolitical changes and the COVID-19 pandemic accelerated the digital workplace and remote work, leading to a required directive update.
The NIS2 directive sets out to harmonize cybersecurity in all member states and bring it up to a higher level. 

To align the entire Union, the NIS2 directive also aims to share knowledge and best practices by imposing incident reports on local authorities.

The NIS2 directive divides affected organizations or entities into two categories:

Essential entity (EE): 

• Energy. Including electricity, district heating and cooling, oil, gas, and hydrogen.
• Transport. Including air, rail, water, and road. 
• Banking. Including financial market infrastructures.
• Healthcare. Including the manufacture of pharmaceutical products and vaccines. 
• Drinking water. 
• Wastewater. 
• Digital infrastructure. Including internet exchange points, DNS service providers, TLD name registries, cloud computing service providers, data center service providers, content delivery networks, trust service providers, providers of public electronic communications networks, and publicly available electronic communications services.
• ICT service management. Including managed service providers and managed security service providers, public administration, and space

Important entity (IE):

• Postal and courier services 
• Waste management 
• Chemicals 
• Food 
• Manufacturing of medical devices, computers and electronics, machinery and equipment, motor vehicles, trailers and semi-trailers, and other transport equipment.
• Digital providers include online marketplaces, search engines, and social networking service platforms. 
• Research organizations.
   

Yes, absolutely. Because of two reasons:

• Affected organizations are responsible for securing their supply chain and supplier relationships, according to NIS2. This means many organizations doing business with affected organizations must comply with NIS2 or risk losing contracts.
  
  Organizations outside the European Union are not directly affected by NIS2. However, they might want to comply to keep doing business with European organizations responsible for their supply chain.

• To secure your own business operations. Ensure your organization’s security standards are up to at least the NIS2 requirements to protect your business.

The NIS2 Directive defines fines for non-compliance according to the essential and important entities above.

• Essential entity. Ten million euros, or 2% of annual turnover.

• Important entities. Seven million euros, or 1,4% of annual turnover.

There are also further sanctions involved. These include temporary bans of senior management and also temporary suspension of business.

Depending on the country, fines might not apply to the public sector. However, the other administrative sanctions might.
 

Incidents must be reported to the local Computer Security Incident Response Teams (CSIRT).
An incident, according to NIS2, falls under two categories.

• Something that has caused or is causing severe operational disruption.

• Something that has, or can, affect natural or legal persons with considerable material or non-material damage.

Additionally, organizations can submit voluntary reports of non-significant incidents, prevented incidents, or cyber threats in general.

Regarding the actual reporting, three steps must be taken within specific timeframes.

• Within 24 hours. Significant incidents should be reported, and an early warning should be communicated.

• 72 hours. A full notification report containing assessment, severity, impact, and indicator of compromise should be reported.

• One month. A full report of the incident must be submitted.
   

The Digital Operational Resilience Act (DORA), which came into effect in 2023, and NIS2 share many similarities regarding cybersecurity.

DORA aims primarily to strengthen the security and cyber resilience of banking and financial institutions. 
The security measures are similar to NIS2, but NIS2 covers a larger group of entities outside the financial sector.
 

NIS2 and ISO27001 serve different purposes, but they do complement each other. If your organization is certified for, or is working towards, ISO 27001, much of the work needed for NIS2 compliance should already be implemented. 

Both strongly emphasize risk management and assessment, so by following ISO 27001, you are fulfilling one of the essential requirements for NIS2.

Not directly, but they do operate within a similar space.

GDPR is, in short, a regulation requiring organizations operating within the European Union to have control over their data, what is stored, why, and for how long. Failure to comply with the regulation will lead to severe fines.

NIS2 is, in short, a regulation requiring organizations based in the European Union to have a solid cybersecurity strategy and to report any significant incidents to authorities.

However, much of the work that organizations did to comply with GDPR should also make it easier to gain compliance with NIS2.