EU NIS 2

The Network and Information Security Directive (NIS) is an EU cybersecurity Directive which aims to achieve a high level of protection and resilience of critical infrastructure. NIS 2 updates and repeals NIS by expanding the scope to cover more types of organizations, adapting the cybersecurity measures to the current threat scenario and tightening the incident reporting requirements.

To increase cyber resilience, NIS 2 requires essential and important entities to implement robust technical, operational, and organizational cybersecurity measures to prevent or minimize disruptions from a wide range of hazards, from cyberattacks to physical incidents.

Compliance with NIS 2 helps to protect your operations and boost resilience, safeguarding your stakeholders and reinforcing trust in your services. It is also notable that NIS 2 aims for stricter enforcement and harmonizes the regime for fines across the EU Member States. Fines for essential entities are the greater of EUR 10 million, or 2% annual worldwide turnover, and for important entities, the greater of EUR 7 million or 1.4% annual worldwide turnover.

Same as NIS, NIS 2 has an extra-territorial scope and applies also to companies around the world when operating in the EU. Businesses without an establishment in the EU are also required to appoint a representative as their addressee for authorities.