Question 1

What is NIS2?

Accepted Answer

NIS2 is the second iteration of the Network and Information Security Directive, aimed at enhancing cybersecurity across the European Union. It expands upon the original NIS Directive, covering more sectors and imposing stricter requirements on organizations.

Question 2

When will NIS2 come into effect?

Accepted Answer

NIS2 entered into force on January 16, 2023. EU member states have until October 17, 2024, to transpose it into national law. The directive will become fully applicable on October 18, 2024.

Question 3

Which sectors are covered by NIS2?

Accepted Answer

NIS2 covers a wide range of sectors, including energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, public administration, space, postal and courier services, waste management, chemicals, food, manufacturing, and digital providers.

Question 4

What are the main differences between essential and important entities?

Accepted Answer

Essential entities are subject to a more stringent supervisory regime with full ex-ante and ex-post supervision. Important entities face a lighter ex-post supervisory regime, where regulators intervene only when provided with evidence of non-compliance.

Question 5

What are the key obligations under NIS2?

Accepted Answer

Key obligations include conducting risk assessments, implementing appropriate security measures, incident reporting, ensuring business continuity, managing supply chain security, and developing cybersecurity policies.

Question 6

How does NIS2 handle incident reporting?

Accepted Answer

NIS2 introduces a tiered incident reporting system: an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month of the incident notification.

Question 7

What are the penalties for non-compliance with NIS2?

Accepted Answer

Penalties can be up to €10 million or 2% of global annual turnover (whichever is higher) for essential entities, and up to €7 million or 1.4% of global annual turnover for important entities.

Question 8

How does NIS2 affect organizations outside the EU?

Accepted Answer

Organizations based outside the EU but providing services within the EU may still fall under the scope of NIS2 if they meet certain criteria. It's important for these organizations to assess their obligations under the directive.

Question 9

How does NIS2 interact with other EU regulations like GDPR?

Accepted Answer

While NIS2 focuses on cybersecurity and GDPR on data protection, there are areas of overlap. Organizations need to ensure compliance with both regulations, particularly in areas such as incident reporting and security measures.

Question 10

What steps should organizations take to prepare for NIS2?

Accepted Answer

Organizations should start by assessing whether they fall within the scope of NIS2, conduct a gap analysis of their current cybersecurity measures, develop an implementation roadmap, and begin enhancing their cybersecurity capabilities in line with NIS2 requirements.

Frequently Asked Questions