NIS2

Who it applies to

Medium and large organisations in listed sectors (such as energy, transport, banking, health, digital infrastructure, ICT service management, public administration, manufacturing and digital providers), classed as essential or important entities, plus some entities designated regardless of size. Obligations come from each Member State's national transposition.

Key requirements

• Cybersecurity risk-management measures covering, among others, incident handling, business continuity, supply chain security, vulnerability handling, cryptography, access control and multi-factor authentication.
• Management bodies must approve the measures, oversee them and receive training, and can be held liable for failures.
• Staged reporting of significant incidents to the national CSIRT or competent authority.
• Registration with the national authority where required by the Member State.
• Supervision: proactive (ex ante) for essential entities, reactive (ex post) for important entities.

Breach and incident notification

For significant incidents: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of the incident notification. Recipients of services may also need to be informed.

Penalties

Member States must allow fines of at least up to EUR 10 million or 2% of worldwide annual turnover (whichever is higher) for essential entities, and at least up to EUR 7 million or 1.4% for important entities.

Go deeper