NIS2 Directive: Cybersecurity within the EU

Cybersecurity has become a key element in ensuring the stability and security of digital services. The European Union has recognized this and set new standards for cybersecurity with the NIS2 Directive, which will impact a wide range of companies operating in the digital space.

Cybersecurity at the Forefront: An Introduction to the NIS2 Directive

The NIS2 Directive is an upgrade to the first EU legislation on cybersecurity, the NIS Directive. Its main goal is to increase security requirements, address supply chain security, streamline reporting, and introduce stricter supervisory measures and stricter enforcement requirements. The proposal expands the scope of entities and sectors that must take measures to increase cybersecurity in Europe.

Scope of the NIS2 Directive: Who is Included?

The NIS2 Directive will affect a wide range of companies operating in the European Union. It includes all medium and large entities that are active in sectors covered by the NIS2 framework. This includes new sectors such as telecommunications, social media platforms, and public administration. This broad scope is designed to ensure that key parts of the digital infrastructure are protected and resilient to cyberattacks.

Key Points for Compliance with the NIS2 Directive: What Do You Need to Do?

For compliance with the NIS2 Directive, companies will need to meet several key points. Some of them are:

• Incident Response: Companies must be prepared for rapid and effective response to potential cyber incidents. This includes developing and implementing incident response plans that enable quick detection, analysis, and remediation of security incidents.
• Supply Chain Security: Companies must ensure that their suppliers and partners in the supply chain comply with the NIS2 Directive requirements. This means that companies must assess and manage cybersecurity risks associated with suppliers and partners.
• Vulnerability Disclosure: Companies must have procedures for detecting and managing security vulnerabilities. This includes regular scanning and testing of systems for vulnerability detection and timely remediation of discovered vulnerabilities.
• Incident Reporting: The NIS2 Directive introduces a two-tier approach to incident reporting. Affected companies have 24 hours from the moment they first detected an incident to submit an initial report, followed by a final report no later than one month later.
• Penalties for Violations: The Directive sets a minimum list of administrative sanctions for cases where entities violate rules regarding cybersecurity risk management or their reporting obligations, as set out in the NIS Directive. These sanctions include binding instructions, an order to carry out security audit recommendations, an order to align security measures with NIS requirements, and administrative fines (up to 10 million euros or 2% of the total global turnover of entities, whichever is higher).

For successful fulfillment of these requirements, companies will need to develop comprehensive cybersecurity strategies that include technical, organizational, and administrative measures to protect their information systems and data.

Preparing for the Future of Cybersecurity

Cybersecurity is of paramount importance to any company operating in the digital world. With the introduction of the NIS2 Directive, the European Union is setting new standards for cybersecurity. Companies must be prepared for these changes and take the necessary measures to ensure compliance with the new requirements. This means not only meeting minimum requirements but also understanding how cybersecurity integrates into the company's overall strategy. By understanding and implementing the NIS2 Directive, companies not only meet legal requirements but also strengthen their resilience to cyberattacks and ensure that their digital services are safe and reliable.