The End Of A Dry Spell – NIS 2 Published

After several delays, the revision of the NIS Directive was published in the Official Journal of the European Union on 27 December 2022 in the form of Directive (EU) 2022/2555 ("NIS 2").

The NIS 2 is the Commission's response to the inconsistent and fragmented implementation of the NIS Directive (EU) 2016/1148 ("NIS 1") by the Member States, which has been criticised on several occasions by stakeholders and the Commission itself.

The revision of this first piece of EU-wide legislation on cybersecurity comes with significant and far-reaching changes for entities in "critical" sectors.

Key features

a. Extension of the scope

Under the NIS 1, Member States were responsible for determining which entities met the criteria to be classified as operators of essential services. The NIS 2 addresses this deficiency by introducing a size cap rule as a general rule for determining regulated entities. This rule is based on Commission Recommendation of 6 May 2003