NIS2 Direc­tive

What is the purpose of the NIS2 Direc­tive?

The NIS2 Direc­tive aims at a high common level of cyber­se­cu­rity in the EU. The orig­inal NIS direc­tive from 2016 covered rela­tively few oper­a­tors and was imple­mented very differ­ently across member states. NIS2 harmo­nizes the rules, widens the scope, adds supply chain secu­rity and makes cyber­se­cu­rity a manage­ment respon­si­bility. Its expanded scope covers far more sectors and compa­nies than before. NIS2 is part of the EU cyber­se­cu­rity legis­la­tion package together with the Cyber Resilience Act, which covers prod­ucts, and the EU Cyber­se­cu­rity Act, which estab­lished ENISA’s perma­nent mandate and a certi­fi­ca­tion frame­work.

Who must comply with the NIS2 Direc­tive?

The scope of NIS2 covers medium-sized and large orga­ni­za­tions in each sector listed in two annexes. Annex I covers sectors of high crit­i­cality such as energy, trans­port, banking, health, drinking water, digital infra­struc­ture and public admin­is­tra­tion. Annex II covers other crit­ical sectors, including manu­fac­turing of:

• medical devices
• computers, elec­tronic and optical prod­ucts
• elec­trical equip­ment
• machinery and equip­ment
• motor vehi­cles and other trans­port equip­ment

Chem­i­cals and food produc­tion are also in scope. Orga­ni­za­tions are clas­si­fied as essen­tial enti­ties or impor­tant enti­ties, mainly by sector and size. A mid-sized machine builder is typi­cally an impor­tant entity. Some orga­ni­za­tions, such as providers of certain digital infra­struc­ture, are covered regard­less of size. Member states may add further enti­ties.

What are the main cyber­se­cu­rity require­ments under NIS2?

The key NIS2 require­ments are risk manage­ment, reporting oblig­a­tions and manage­ment account­ability. Article 21 requires appro­priate tech­nical, oper­a­tional and orga­ni­za­tional cyber­se­cu­rity measures based on an all-hazards approach. Each require­ment is a minimum, and compe­tent author­i­ties can ask for more. The minimum list includes:

• poli­cies on risk analysis and infor­ma­tion system secu­rity
• inci­dent handling and inci­dent response, busi­ness conti­nuity, backup manage­ment and crisis manage­ment
• supply chain secu­rity, including secu­rity aspects of rela­tion­ships with suppliers
• secu­rity in acqui­si­tion, devel­op­ment and main­te­nance of systems, including vulner­a­bility handling
• assess­ment of the effec­tive­ness of cyber­se­cu­rity risk manage­ment measures
• basic cyber hygiene and cyber­se­cu­rity training
• cryp­tog­raphy and encryp­tion, access control and asset manage­ment
• multi-factor authen­ti­ca­tion and secured commu­ni­ca­tions where appro­priate

Manage­ment bodies must approve these cyber­se­cu­rity measures, oversee their imple­men­ta­tion and take part in training. They can be held liable for non-compli­ance. Super­vi­sory author­i­ties can carry out an audit, espe­cially for essen­tial enti­ties, and many compa­nies use recog­nized cyber­se­cu­rity stan­dards such as ISO 27001 and IEC 62443 to struc­ture their NIS2 compli­ance.

Inci­dent reporting under NIS2

The reporting require­ments apply to signif­i­cant cyber­se­cu­rity inci­dents, which must be reported to the national CSIRT or compe­tent authority in stages: an early warning within 24 hours, an inci­dent noti­fi­ca­tion within 72 hours and a final report within one month. A signif­i­cant inci­dent is one that causes or can cause severe oper­a­tional disrup­tion or finan­cial loss, or consid­er­able damage to others.

What NIS2 means for industry and OT

For manu­fac­turers, NIS2 compli­ance reaches into the shop floor. Produc­tion systems are part of the network and infor­ma­tion systems an entity must protect, so OT secu­rity becomes a compli­ance topic, not only an IT one. Supply chain secu­rity also works in both direc­tions: manu­fac­turers in scope must assess their suppliers, and suppliers of compo­nents and soft­ware will be asked for evidence of their secu­rity prac­tices, such as vulner­a­bility handling and SBOMs. The OI4 Indus­trial Cyber Secu­rity work­group addresses these topics, and the OI4 down­loads include a white paper on the NIS2 Direc­tive.

NIS2 and the Cyber Resilience Act

NIS2 regu­lates orga­ni­za­tions, the CRA regu­lates prod­ucts. A machine builder can be affected by both: by NIS2 as an impor­tant entity for its own oper­a­tions, and by the CRA for the machines and soft­ware it sells. The require­ments fit together, since secure prod­ucts from CRA-compliant suppliers make it easier for oper­a­tors to meet their NIS2 risk manage­ment duties.

Frequently asked ques­tions