The NIS2 directive (Network and Information Security Directive 2) is a major shift in how the EU regulates cybersecurity. It goes much further than the first NIS directive and now applies to far more firms. In Germany, the NIS2 Implementation Act (NIS2UmsuCG) puts it into law. It is expected to affect about 30,000 companies directly. This article explains the key rules and shows how you can get ready.
What Is the NIS2 Directive?
The EU adopted the NIS2 directive in January 2023. Each member state must now turn it into national law. It replaces the first NIS directive from 2016. The reason: threats have grown, and critical infrastructure is more and more linked. The goal is the same high level of cybersecurity across the whole EU.
Who Does NIS2 Affect?
NIS2 splits firms into "essential entities" and "important entities". It covers 18 sectors in total:
- Essential sectors: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, and space.
- Important sectors: postal and courier services, waste management, manufacturing, making and selling chemicals, food production, processing industry, digital providers, and research institutions.
As a rule, a firm is in scope if it works in one of these sectors and has 50 or more staff or more than 10 million euros in yearly revenue. Some entities fall under the directive no matter their size. These include DNS services, TLD registrars, and providers of public electronic communication networks.
Core Requirements of NIS2
Risk Management Measures
NIS2 calls for a full, risk-based approach to cybersecurity. Firms must put technical, operational, and organizational measures in place. These must match the state of the art and fit the risk. The minimum measures are:
- Risk analysis and security concepts for IT systems
- Handling of security incidents
- Business continuity and crisis management
- Supply chain security
- Security when you buy, build, and maintain IT systems
- Ways to check whether the measures work
- Basic cyber hygiene and security training
- Cryptography and encryption
- Staff security, access control, and asset management
- Multi-factor authentication and secure communication
Reporting Obligations
NIS2 makes the rules for reporting security incidents much stricter. Firms in scope must report major incidents in three stages:
- an early warning within 24 hours,
- a detailed report within 72 hours,
- a final report within one month.
The reports go to the national authority in charge. In Germany, this will most likely be the Federal Office for Information Security (BSI).
Management Accountability
A key point of NIS2 is that top management is personally accountable. The board must approve security measures and oversee how they are carried out. Its members must take part in security training. They can be held personally liable if they fail in their duties. This makes clear that cybersecurity is not just a matter for IT. It is a job for the people who lead the company.
Practical Steps to NIS2 Compliance
- Check if NIS2 applies: first find out whether your firm falls under NIS2. If so, check whether it counts as an essential or an important entity.
- Gap analysis: rate how mature your security is today. Then find the gaps against the NIS2 rules.
- Risk assessment: run a full risk assessment. Cover all IT systems and business processes that matter.
- Action plan: draw up a plan that ranks the steps to close the gaps you found.
- Put it in place: carry out the measures. This runs from technical controls to written policies to reporting processes.
- Training: train top management and staff on the new rules and on their role in security.
- Keep improving: set up processes to review and improve your security measures on a regular basis.
Conclusion
NIS 2 is less a new layer of red tape and more a push to improve. Firms that meet the rules with a sound ISMS and solid processes raise their security level for good. They do more than just produce proof. Start early, focus on getting things done, and bring top management in from day one. That is how new duties turn into real gains in resilience. It also protects your leaders from personal liability.