The NIS 2 Era Is Here: Are You Compliance-Ready?

With the deadline for Member States to transpose the European Union's updated Network and Information Systems Directive (Directive (EU) 2022/2555) ("NIS 2" or "Directive") into national law having passed on 18 October 2024, organisations operating in or servicing the EU market face significant new cybersecurity obligations. The revised Directive, which repeals and expands on the original NIS framework ("NIS 1"), broadens its regulatory scope and imposes enhanced compliance requirements to address the growing threats in a new era of digitalisation.

Background of the NIS 2 Directive

NIS 1 (introduced in 2018) primarily impacted 'operators of essential services' and 'digital service providers', such as online search engines and cloud services, requiring them to maintain a certain level of cybersecurity. However, NIS 2 expands on these categories, replacing them with 'essential' and 'important' classifications. If an organisation is deemed 'important' or 'essential'