Question 1

What is NIS2?

Accepted Answer

NIS2 is an EU directive that replaces the existing NIS directive, which has been in force since 2013. NIS stands for Network and Information Security. The directive applies to the whole of the EU and aims to ensure a high and uniform level of cyber and information security so that critical infrastructure and society-critical services are better equipped against breakdowns and cyber threats from outside. The new NIS2 directive covers far more sectors than before, and it tightens the requirements for supervision while introducing the possibility of holding management personally liable for breaking the law.

Question 2

Who is covered by NIS2?

Accepted Answer

NIS2 covers far more sectors than the original NIS Directive. All players within critical infrastructure are covered, including their suppliers. The directive specifies 17 segments: energy, transport, finance (banking), financial market infrastructures, health, drinking water, wastewater, digital infrastructure, public administration, outer space, mail, waste management, chemicals, food, digital providers, education, and research. Smaller companies with fewer than 50 employees or with a turnover of less than 10 million euros are not covered, but there are several exceptions. Furthermore, it is up to the local authorities to specify who is covered. The directive distinguishes between "essential" and "important" segments, and depending on which segment you belong to, different requirements apply.

Question 3

What is the purpose of NIS2

Accepted Answer

The purpose of the NIS2 directive is multifaceted, but its essence is to strengthen the EUs security and ensure common ground across member states. The directive covers both the understanding and implementation of cybersecurity, applying to both the public sector and private actors.

Question 4

When will NIS2 come into effect?

Accepted Answer

The directive must first be implemented as legislation in the respective countries, and the companies concerned are then given a "grace period" to comply with the legislation. However, NIS2 must be implemented in all covered European companies, authorities, and organizations by 2024 at the latest. After that, it will be the responsibility of local authorities to enforce the directive, similar to the current situation with GDPR.

Question 5

What are the requirements of NIS2?

Accepted Answer

The requirements in NIS2 include, among other things: Policies for risk analysis and information system security Incident management (prevention, detection, and response to incidents) Business continuity and crisis management Supply chain security, including security-related aspects of relationships between entities and their suppliers or service providers, such as data storage and processing services or managed security services Security in connection with the acquisition, development, and maintenance of network and information systems, including the handling and disclosure of vulnerabilities Policies and procedures (testing and auditing) for assessing the effectiveness of measures to manage cybersecurity risks Use of cryptography and encryption.

Learn all about the products and services we offer in our whitepapers.

Let OT and IT play together safely – and gain insight into production

Wi-Fi 7 – Free guide for businesses

NIS2: Vision, key objectives, and tactical strategies for your organization

Cortex: How to get an overall overview and take back control

Cisco FSO: Full visibility into the entire technology stack – the key to stable IT operations

Cybersecurity and the human aspect

Dissecting Russian State-sponsored Threat Actors

SD-WAN and SASE – The journey to a more secure network – Secure Access Service Edge

WiFi 6 – Your guide to the new wireless standard

What is AIOps? – AI for the IT department

Pure as-a-Service

Stopping cybercrime from stopping business

Conscia IoT Device Portal

Secure Email Means Secure Business

How you successfully introduce (MFA) multi-factor authentication

Zero Trust – Going Beyond the Perimeter

How to Segment your Industrial Network – a practical methodology!

Do you have any questions?

Contact