New Cybersecurity Obligations On The Way For Essential Service Providers

After nearly three years of intensive negotiations, the first comprehensive cybersecurity legislation in the EU is nearing its final adoption. The EU Network and Information Security Directive will establish a cybersecurity cooperation infrastructure between EU member states and introduce information security obligations for operators of vital services and key digital service providers. These entities will be required to implement appropriate technical and organisational measures to prevent and minimise the impact of network and information incidents, demonstrate effective implementation of security policies, and notify serious cyber incidents to competent authorities. Businesses operating in key sectors of the economy, such as energy, transport, financial market infrastructures, and health and digital infrastructures, should be aware of these new obligations and update their cybersecurity policies and processes.