What is the NIS 2 directive?

The NIS 2 (Network and Information Security) directive is a European Union regulation designed to strengthen the cybersecurity of companies operating in critical sectors. It replaces the NIS 1 directive, broadening its scope and imposing stricter requirements.

Objectives :

• Improving the resilience of critical infrastructures
• Harmonizing safety levels
• Reinforce reporting obligations in the event of an incident

Why a new directive?

The NIS 1 Directive, adopted in 2016, aimed to improve the cybersecurity of critical infrastructures. However, it had limitations in terms of application and coverage of the sectors concerned.

NIS 2 therefore extends its scope and imposes stricter requirements to better protect Europe's digital economy.

‍

For whom?

NIS 2 extends the list of entities subject to regulation. It applies to medium-sized and large companies in the following sectors:

• Energy, transport, banking and financial infrastructure
• Health, drinking water and wastewater
• Digital services, public administration, telecommunications
• Cybersecurity service providers

Smaller companies can also be affected if they play a key role in these sectors.

Failure to comply with the NIS 2 directive can result in severe penalties, including fines of up to €10 million or 2% of annual worldwide sales. In addition, companies may face enhanced audits and compliance obligations, or face further sanctions.

NIS 2 extends the scope of NIS 1 and imposes stricter requirements to better protect Europe's digital economy. Key obligations include:

• Risk management: Identifying and preventing cyberthreats.
• Network and information systems security: Implementation of robust technical and organizational measures.
• Incident reporting: Significant incidents must be reported to the relevant authorities within 24 to 72 hours.
• Governance and accountability: Senior management must be involved in risk management, and can be held personally liable in the event of non-compliance.

Companies are classified into two categories:

• Essential entities: Sectors such as energy, transport, banking, financial infrastructure, healthcare, drinking water, public administration and digital infrastructure.
• Major entities: Mid-sized or strategically important companies in sectors such as waste management, critical manufacturing, food production and digital services.

The NIS 2 directive does not provide for formal certification, but does require the implementation of robust security measures and the notification of incidents to the relevant authorities.

Key steps to prepare for NIS 2 include:

1. Evaluate eligibility : Identify whether the organization is classified as an essential or significant entity.
2. Perform a compliance audit: Identify deviations from NIS 2 regulations
3. Implement an action plan: define corrective measures and reinforce safety protocols.
4. Train employees: Raise awareness and train teams in cybersecurity and regulatory obligations.
5. Establish an incident response process: Put in place an effective procedure for reporting and managing incidents.
6. Collaborate with authorities and partners: Interact with regulators and industry partners to ensure effective compliance.

To comply with the NIS 2 directive, a company can rely on ISO 27001 certification. This standard covers many of the directive's requirements in terms of risk management, information systems protection and incident response. Obtaining ISO 27001 certification will help structure your cybersecurity and facilitate alignment with NIS 2.