The EU Cybersecurity Directive1, known as the
"NIS Directive" was published on 19 July 2016 in the
Official Journal of the European Union. The NIS Directive entered
into force on 8 August 2016 and the Member States will have to
transpose the Directive into their national laws by 9 May 2018.
The NIS Directive pursues a high common level of security of
network and information systems within the EU and therefore uniform
protection against incidents. It is considered "the first
comprehensive piece of EU legislation on
cybersecurity2".
Who is directly impacted by the NIS directive?
- Operators of an essential
service (presumed to be vital for our economy and society
and, moreover, relying heavily on ICTs): energy, transport,
banking, financial market infrastructures (e.g. stock exchanges,
central counterparties), health services, drinking water supply and
distribution and digital infrastructure - as listed in Annex II to
the NIS Directive. The competent authorities
