What is the NIS 2 directive?
The European Commission's NIS 2 Directive contains a set of cybersecurity measures and proposals to further develop proactive defence and incident management strategies with competent authorities and public and private organisations. It was designed to replace the original NIS Directive, which failed to be implemented during the COVID-19 pandemic, which has reshaped society's relationship with the digital world.
The NIS 2 Directive is in line with the European Commission's ambition to protect Europe in the digital age and ensure the future-proofing of the economy. It was adopted by the European Parliament on 10 November 2022 and by the Council on 28 November, thus starting the repeal of the previous NIS Directive.
Who does the NIS 2 Directive apply to?
The NIS 2 Directive applies to organisations operating in the private and public sectors in the European Union. This includes, among others, healthcare, energy, transport and digital infrastructure.
The European Union currently has 27 European countries: Austria, Belgium, Bulgaria, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Greece, Netherlands, Croatia, Ireland, Latvia, Lithuania, Luxembourg, Malta, Poland, Hungary, Germany, Italy, Portugal, Romania, Slovakia, Slovenia, Spain and Sweden.
The NIS 2 Directive applies to all of these areas and should be implemented by all organizations operating in these areas according to the following timetable:
The NIS 2 Directive applies to organisations operating in the private and public sectors in the European Union. This includes, among others, healthcare, energy, transport and digital infrastructure..
The European Commission sets out the technical and methodological requirements in all cybersecurity areas covered by the NIS 2 Directive. All Member States of the European Union must adopt and publish measures to comply with this.
Member States must apply the measures from that date. From that date, the previous NIS Directive will cease to apply.
On this day, the NIS Cooperation Group will establish a framework based on which assessments will be carried out by cybersecurity experts designated by the Member States.
Each Member State must submit a list of core organisations, as well as those providing services related to domain name registration. This list will be updated every two years.
Starting from today, and every 36 months thereafter, the European Commission will evaluate the effectiveness of the NIS 2 Directive and report to the European Parliament and the Council.
COMPLIANCE
SECOPS
IT
TO WHICH IT APPLIES
NIS 2 Directive Objectives and Components
The main objective of the NIS 2 Directive is to provide EU Member State organisations with the tools to prepare for and protect against cybersecurity incidents in a manner that is consistent with the current digital environment. To this end, it covers areas such as:
Incident management
Asset and vulnerability management
Access management
Risk analysis and management policy
Supply chain security
MFA and encryption
Disaster recovery and data backup
Cybersecurity training
Areas covered by Heimdal according to NIS 2 directive
Areas detected by Heimdal® in accordance with NIS 2 directive
NIS compliance with Heimdal
START YOUR CYBERSECURITY MEASURES IN ADVANCE