Cyber Security Update: NIS2 Directive On Cyber Security Adopted

The NIS Directive (EU 2016/1148) was the first piece of EU-wide legislation on cybersecurity. Now it's expanded revision, the NIS2 Directive (NIS2D), has finally been adopted and from publication in the Official Journal, Member States will have 21 months to transpose it into national law. It is therefore expected to enter into force sometime in 2024.

But what differs in NIS2D and how does it affect organisations?

Background

The NIS2D is a response to the ever-growing cyber-attack landscape within the EU and worldwide. It aims to ensure a high, common level of cybersecurity across the EU. The NIS2D updates and expands the scope of the pre-existing framework (the NIS Directive) to include medium and large businesses from more critical sectors (e.g. manufacturing of critical products (including medical device manufacturers), postal and courier services, public administration, digital services). The NIS2D will also put cybersecurity and breach reporting