The NIS 2 Directive: What You Need to Know

The NIS 2 Directive raises the bar for cybersecurity across the EU by a large step. It makes three big changes:

• Far more companies and bodies now fall under the rules.
• Top management is held personally to account.
• It asks for clear technical and organizational measures.

This article explains what matters if your company is affected.

What Is the NIS 2 Directive?

The NIS 2 Directive (Network and Information Security Directive 2, EU 2022/2555) follows the NIS Directive of 2016. Each EU country must turn it into national law. In Germany, this is planned through the NIS2 Implementation Act (NIS2UmsuCG). The goal is the same high level of security for network and information systems across the EU.

Who Is Affected?

NIS 2 splits companies into essential and important entities. As a rule, it applies if you work in one of the listed sectors and have 50 or more staff or €10M in yearly turnover. The sectors are:

• Sectors of high criticality: Energy, transport, banking, financial market infrastructures, health, drinking water and waste water, digital infrastructure (cloud, data centers, DNS, TLD), space, public administration.
• Other critical sectors: Postal and courier services, waste management, chemicals, food, manufacturing (medical devices, electronics, machinery, motor vehicles), digital providers (online marketplaces, search engines, social networks), research.

Some groups fall under the directive no matter how big they are. These include providers of critical services, qualified trust service providers, TLD name registries, DNS service providers and parts of public administration.

Core Duties

Risk management measures

At the very least, you need:

• risk analysis
• incident handling
• business continuity
• supply chain security
• vulnerability management
• cryptography
• access control
• multi-factor authentication
• training

Duty to report

You must report serious security incidents to the responsible authority in three steps:

• an early warning within 24 hours
• an assessment within 72 hours
• a final report within one month

Duties of management, registration and fines

• Management is responsible: Top management must approve the measures and oversee how they are put in place. Managers are held personally to account. Regular training is a must.
• Registration: Affected entities must register with the responsible national authority. In Germany, this is the BSI.
• Fines: Up to €10M or 2% of global yearly turnover for essential entities. Up to €7M or 1.4% for important entities. The higher amount applies.

How to Prepare Your Company

1. Check if NIS 2 applies: Find out whether NIS 2 covers you, and in which category.
2. Gap analysis: Compare your current security to the NIS 2 rules. An existing ISMS already covers many of them. This is true above all if it follows ISO 27001.
3. Map your supply chain: List your critical service providers and how secure they are. Update the security terms in your contracts.
4. Set up incident response: Define the chain for the 24- and 72-hour reports. Build the technical means to detect attacks (SOC, EDR).
5. Train management: Give top management and other managers regular training, and keep records of it.
6. Registration and reporting channels: Name the people in charge. Prepare how you will talk to the responsible authority.

Conclusion

NIS 2 is not a paper tiger. Many more companies fall under it, and the rules are more precise. Personal liability for management is new, and it comes with high fines. Companies that already run a mature ISMS have a clear head start. Everyone else should start now with a planned gap analysis and set clear priorities. Do not wait for the national law.