On January 16, 2023, the Directive on measures for a high common level of cybersecurity across the Union (the “NIS2 Directive”) and the Directive on the resilience of critical entities (“CER Directive”) entered into force. The NIS2 Directive repeals the current NIS Directive and creates a more extensive and harmonized set of rules on cybersecurity for organizations carrying out their activities within the European Union. The CER Directive repeals the European Critical Infrastructure Directive and brings with it new, stronger rules for the cyber and physical resilience of critical entities and networks.

Key Takeaways from the NIS2 Directive

A broader scope of application

The number of organizations subject to obligations under the NIS2 Directive will grow significantly in comparison with the original framework. This is largely because, under the original NIS Directive, Member States had to designate entities considered as essential and therefore subject to the obligations of the original NIS Directive, which is no longer the case.  Now, the new NIS2 Directive defines which organizations the obligations apply to, which amounts to a broader scope of entities.  

For example, the concept of “essential entities” replaces “operators of essential services”; it is likely that most organizations classified as “operators of essential services” under the original NIS Directive will be classified as “essential entities” under the NIS2 Directive. However, the concept of an “essential entity” is much broader and will also capture many organizations that have, to-date, not been subject to the NIS regime—for example, pharmaceutical companies and operators of hydrogen production, storage and transmission.

In addition, the concept of “digital service provider” that was included in the original NIS Directive has been removed from the NIS2 Directive, in favor of the concept of “important entities,” which will likely include those organizations considered “digital service providers” under the original NIS Directive and additional categories. Important entities will be subject to more stringent obligations under the NIS2 Directive than digital service providers were under the original NIS Directive.

Reinforced obligations

Under the NIS2 Directive, essential and important entities must implement technical, operational and organizational measures to manage the risks posed to the security of their network and information systems and to prevent or minimize the impact of incidents. These measures must cover, among others, areas such as incident handling, business continuity, use of encryption and secure authentication and training. 

Reporting of incidents

Essential and important entities must notify, without undue delay, the national computer security incident response teams (CSIRT) or, where relevant, the competent authority, of any incident having a significant impact on the provision of their services. Steps to comply with these obligations include:

• An “early warning,” within 24 hours after having become aware of the incident, indicating whether the incident is suspected of being caused by unlawful or malicious acts or could have a cross-border impact;

• An incident notification, within 72 hours after having become aware of the incident, which shall update the information above and provide an initial assessment of the incident, including regarding its severity and impact;

• When requested by the CSIRT or the competent authority, an intermediate report; and

• A final report, no later than one month after the submission of the incident notification. The final report must include a detailed description of the incident, including the likely cause of the incident, the mitigation measures applied, and any cross-border impact of the incident.

Notification to recipients of services may also be required in certain situations.

Enforcement

Competent authorities will be able rely on a robust set of enforcement and investigation powers, such as the ability to conduct raids, perform security audits and request data, information and documents (amongst others). 

Importantly, Member States must provide authorities the ability to impose considerable fines:

• For essential entities, of at least up to €10 million or 2% of the worldwide annual turnover.

• For important entities, of at least up to €7 million or 1.4% of the worldwide annual turnover.

Management bodies of essential and important entities may also be held liable for non-compliance with the provisions of the NIS2 Directive.

Key Takeaways from the CER Directive

The new rules will strengthen the resilience of critical infrastructure to a range of threats, including natural hazards, terrorist attacks, insider threats, or sabotage, all of which could, of course, have a cyber security or other related element. The CER Directive applies to 11 sectors which have been deemed critical: energy, transport, banking, financial market infrastructures, health, drinking water, wastewater, digital infrastructure, public administration, space and food.

Member states will need to have a national strategy to enhance the resilience of critical entities, carry out a risk assessment at least every four years and identify the critical entities that provide essential services. Critical entities will need to identify the relevant risks that may significantly disrupt the provision of essential services, take appropriate measures to ensure their resilience and notify disruptive incidents to the competent authorities.

Next Steps

Unlike EU regulations, EU directives do not have direct effect in EU Member States meaning Member States must now transpose the requirements of the NIS2 Directive and the CER Directive into national law before they become applicable to the relevant organizations.  Member States will have until October 17, 2024 to do so and to publish the measures necessary to comply with both legal instruments. Member States shall apply those measures as from October 18, 2024.

Read the NIS2 Directive and the CER Directive.