After reading, you can work out whether NIS2 applies to you and which duties follow.
Definition
It replaces the first NIS directive and applies through national laws, which were due by 17 October 2024. Since each Member State writes its own, the details vary from country to country.
Annexes I and II list the sectors, among them energy, transport, health, digital infrastructure, food and the manufacture of certain products. Entities are classed as essential or important, a distinction that mainly affects supervision and maximum fines.
Why it matters
Article 20 brings the topic to the boardroom. The management body must approve the measures, oversee them and follow training, and it can be held liable for failures.
Article 34 sets the ceiling for fines at no less than €10 million or 2% of worldwide turnover for essential entities, and €7 million or 1.4% for important ones.
How it works
Begin with scope: your sector, your size and your national law. Generally the directive covers medium and large companies, while some entities fall in whatever their size. Register with the national authority where the law requires it.
Then apply the measures of Article 21, which take an all-hazards approach and are meant to be proportionate to the risk.
Finally, organise reporting under Article 23: an early warning within 24 hours, a notification within 72 hours and a final report within one month.
A worked case
A food manufacturer with 300 staff finds food production and distribution in Annex II and concludes it is an important entity. Its board approves the measures and attends training.
Its incident process gains two things: a named person who decides whether an incident is significant, and the contact details of the national CSIRT.
Good practices
- Read the national law as well as the directive, because deadlines and registration differ.
- Rehearse the 24-hour warning. It is shorter than it sounds when the first hours go to working out what happened.
- If you already run ISO/IEC 27001, build on it and check what is missing.
Common mistakes
- Assuming that staying outside the first NIS directive means staying outside NIS2. The scope grew considerably.
- Leaving it to IT, when the liability sits with management.
- Ignoring it because you are out of scope yourself. Customers who are covered will pass their requirements on by contract.
- Waiting for an incident to find out who reports it.
Questions
- Does NIS2 apply to small companies?
- Generally not, but Article 2 brings certain entities into scope whatever their size, such as some digital infrastructure providers or sole providers of a critical service.
- What is the difference between essential and important entities?
- Essential entities face proactive supervision and higher maximum fines. Important entities are mainly supervised after the event. The measures are the same.
- Is ISO 27001 enough for NIS2?
- It covers much of Article 21. Incident reporting deadlines, registration and national rules still need separate attention.
- Is there an official NIS2 certificate?
- The directive creates no general certificate. Member States may require certain European certification schemes.
- What counts as a significant incident under NIS2?
- Under Article 23, one that has caused or can cause severe operational disruption or financial loss, or considerable damage to others.