The NIS Regulations And Sub-Contractors: The Weakest Link?

The 2016 EU Directive on the Security of Network and Information Systems (the "Directive") seeks to prevent and minimise the impact of cyber security incidents in the EU. The Irish implementing legislation (the "NIS Regulations") were signed into law in September 2018. Of concern to European legislators is the increasing frequency and severity of cyber-attacks on critical infrastructure and online services. The Directive seeks to achieve a high common standard of cyber security for network and information systems throughout the EU, this being of vital importance for the functioning of the internal market and for society more broadly. Entities subject to the NIS Regulations will be subject to a range of risk management and reporting requirements.