NIS 2 Directive — Directive (EU) 2022/2555

Overview

The directive establishes measures to achieve a high common level of cybersecurity across the Union to improve the functioning of the internal market. (Art. 1)

It applies to medium-sized and larger public or private entities operating within covered sectors, certain entities regardless of size (such as electronic communications providers, trust service providers, and top-level domain registries), critical entities, public administration entities, and domain name registration service providers. (Art. 2 Art. 3)

Key points

• Member States must adopt national cybersecurity strategies, establish competent authorities, single points of contact, computer security incident response teams (CSIRTs), and cyber crisis management authorities by 17 October 2024. (Art. 1 Art. 7 Art. 8 Art. 9 Art. 10 Art. 41)
• Member States must ensure that essential and important entities implement appropriate and proportionate technical, operational, and organisational cybersecurity risk-management measures, and establish governance liability for management bodies. (Art. 20 Art. 21)
• Member States must establish reporting obligations requiring essential and important entities to notify their CSIRT or competent authority of significant incidents within specified early warning and notification timelines. (Art. 23)
• Member States must establish supervisory and enforcement frameworks, granting competent authorities powers to conduct inspections, audits, and impose effective, proportionate, and dissuasive administrative fines. (Art. 1 Art. 31 Art. 32 Art. 33 Art. 34 Art. 36)
• Member States must compile and maintain a list of essential and important entities, and submit relevant data regarding identified entities to the Commission and ENISA. (Art. 3)

Structure

The directive is organized into nine chapters: General Provisions, Coordinated Cybersecurity Frameworks, Cooperation at Union and International Level, Cybersecurity Risk-Management Measures and Reporting Obligations, Jurisdiction and Registration, Information Sharing, Supervision and Enforcement, Delegated and Implementing Acts, and Final Provisions.