NIS2 Directive.

What is the NIS2 Directive?

The NIS2 Directive is a European Union law on cybersecurity. Its formal name is Directive (EU) 2022/2555. The European Commission says it establishes a unified legal framework to uphold cybersecurity in 18 critical sectors across the EU. The text of the Directive says it lays down measures that aim to achieve a high common level of cybersecurity across the Union, with a view to improving the functioning of the internal market.

Who adopted the NIS2 Directive?

The official title names the European Parliament and the Council as the adopters. It is dated 14 December 2022. The Commission says the Directive replaced the earlier NIS Directive, also called NIS1 (Directive 2016/1148). The Commission also says Member States have to transpose it into national law, so each country writes its own rules to put it into effect.

Who does NIS2 apply to?

The Directive applies to public or private entities of a type listed in its Annex I or Annex II that meet the medium-sized enterprise threshold and provide their services within the Union. The Commission says that, as a rule, medium-sized and large entities in the covered sectors have to take appropriate cybersecurity risk-management measures.

The Directive sorts these organizations into two groups:

• Essential entities. These include entities in Annex I that exceed the medium-sized thresholds, qualified trust service providers, DNS providers, certain public administration entities and certain electronic communications providers.
• Important entities. These are entities in Annex I or Annex II that do not qualify as essential.

The Commission lists sectors such as energy, transport, healthcare, finance, water management and digital infrastructure. It also names postal and courier services, waste and wastewater management, public administration and the space sector.

What does NIS2 broadly ask for?

The Commission describes four broad parts.

• Risk management. Covered entities have to take appropriate cybersecurity risk-management measures.
• Incident reporting. Entities have to notify the relevant national authorities of significant incidents.
• Supervision. The Directive includes provisions for supervision, enforcement and voluntary peer reviews.
• Cooperation. The Directive sets up networks such as the CSIRTs network (CSIRT stands for computer security incident response team) and EU-CyCLONe for coordinated incident response and information exchange.

The Directive also asks each Member State to adopt a national cybersecurity strategy and to designate or establish CSIRTs covering the sectors in its annexes.

Is NIS2 the same as NIS1?

No. NIS1 was the earlier Directive (EU) 2016/1148. The official text of NIS2 repeals it, and the Commission says NIS2 replaced it.

Does this page show that an organization is covered or compliant?

No. This page is a plain summary of what the official sources say. It is not legal advice. Whether an organization is covered depends on the annexes of the Directive and on the national law of the Member State. The official texts linked below are the place to check.

How does NIS2 relate to nearby terms?

Related glossary terms include third-party risk, incident response plan and supply chain attack.