EU Adopts Enhanced Legal Framework To Provide For High Common Level Of Cybersecurity

Following the European Parliament's approval on November 10, 2022, the Council of the European Union announced on November 28, 2022, that it adopted the new Directive (EU) 2022/0383 on measures for a high common level of cybersecurity across the Union ("NIS 2"), repealing Directive (EU) 2016/1148.

Aim and Scope

Based on the experience to date with Directive (EU) 2016/1148, NIS 2 aims at further harmonizing cybersecurity requirements and their implementation across the EU. It extends the scope of both the sectors and entities covered by the former Directive to include: (i) medium-sized and large "essential and important" entities operating in new sectors, including public electronic communications networks or services, social networking services platforms and data centers, space, public administration and manufacture of critical products, such as pharmaceuticals, medical devices, or chemicals; as well as (ii) certain critical "essential and important"