NIS 2 Directive — Directive (EU) 2022/2555

Overview

This Directive aims to achieve a high common level of cybersecurity across the Union to improve the functioning of the internal market. It repeals and replaces the previous NIS Directive (EU) 2016/1148, extending its scope to cover more sectors and services vital to the economy and society. (Art. 1 Art. 44)

The Directive applies to medium-sized and large public and private entities in specific sectors listed in Annexes I (highly critical sectors) and II (other critical sectors). Regardless of size, it also applies to entities like providers of public electronic communications networks, trust service providers, TLD name registries, DNS service providers, critical entities under Directive (EU) 2022/2557, and certain public administration entities. It does not apply to entities whose activities are predominantly in national security, public security, defence, or law enforcement. (Art. 2 Art. 3)

Key points

• Member States must adopt and publish national measures to comply with this Directive by 17 October 2024, and apply them from 18 October 2024. (Art. 41)
• Member States must ensure that essential and important entities take appropriate technical, operational, and organisational measures to manage cybersecurity risks. These measures must address areas such as incident handling, business continuity, supply chain security, and the use of cryptography. (Art. 21)
• Member States must ensure that essential and important entities notify their national Computer Security Incident Response Team (CSIRT) or competent authority of any significant incident without undue delay. An early warning is required within 24 hours, followed by a more detailed notification within 72 hours. (Art. 23)
• Member States must establish a list of essential and important entities by 17 April 2025 and update it at least every two years. They must require these entities to submit identifying information to the competent authorities. (Art. 3)
• Member States must designate or establish competent authorities for cybersecurity, a single point of contact for cross-border cooperation, and one or more CSIRTs with defined technical capabilities and tasks. (Art. 8 Art. 10 Art. 11)
• Member States must ensure that management bodies of essential and important entities approve and oversee their cybersecurity risk-management measures and can be held liable for infringements. Members of these bodies must follow cybersecurity training. (Art. 20)
• Member States must establish rules for administrative fines for infringements of cybersecurity risk-management and reporting obligations. For essential entities, fines shall be a maximum of at least €10,000,000 or 2% of total worldwide annual turnover, whichever is higher. For important entities, the maximum is at least €7,000,000 or 1.4% of turnover. (Art. 34)

Structure

The Directive begins with General Provisions (Chapter I) defining its subject matter, scope, and key terms. Chapter II outlines Coordinated Cybersecurity Frameworks, requiring Member States to have national strategies, competent authorities, and CSIRTs. Chapter III details cooperation mechanisms at the Union level, such as the Cooperation Group and CSIRTs network. Chapter IV sets out Cybersecurity Risk-Management Measures and Reporting Obligations for entities. Chapter V covers Jurisdiction and Registration. Subsequent chapters address Information Sharing (VI), Supervision and Enforcement (VII), Delegated and Implementing Acts (VIII), and Final Provisions (IX) including transposition deadlines and the repeal of the first NIS Directive.

Related instruments

• Directive (EU) 2016/1148 — This Directive repeals and replaces Directive (EU) 2016/1148 (the first NIS Directive), expanding its scope and strengthening security requirements.
• Directive (EU) 2022/2557 — This Directive is linked to the Resilience of Critical Entities (CER) Directive. Entities identified as critical under the CER Directive are automatically considered essential entities under this Directive, ensuring alignment between physical and cyber resilience.
• Regulation (EU) 2022/2554 — This Regulation on digital operational resilience for the financial sector (DORA) is considered a sector-specific Union legal act. Financial entities compliant with DORA's equivalent requirements are exempt from corresponding obligations under this Directive.
• Regulation (EU) 2016/679 (32016R0679) — This Directive is without prejudice to the General Data Protection Regulation (GDPR). It specifies that competent authorities must inform data protection authorities of incidents that entail a personal data breach.