In the following article, we’ll explore what the NIS2 Directive is, what it means for organizations, the key changes it brings, and how it affects the domain name industry.

What Is NIS2 and Why Is It so Important?

NIS2 entered into force on January 16, 2023, and is currently in the process of being transposed into national laws by the EU member states. It is the second EU directive on network and information security and replaces the previous NIS1 directive.

The NIS2 directive is an EU-wide cybersecurity legislation designed to establish a high common level of cybersecurity across all member states. It has been developed to address the growing threats of digitalization and the increase in cyberattacks. The scope of NIS2 has been extended compared to NIS1 by requiring a broader range of entities and sectors to implement measures that will strengthen Europe’s cybersecurity robustness in the long term.

EU member states must incorporate the NIS2 directive into national law by October 17, 2024, but depending on those laws, additional time for implementation of these laws may be granted. The absence of specific requirements for the wording or implementation of these laws could result in 27 different versions within the EU.

The NIS2 directive is an important instrument for strengthening the resilience and security of the critical infrastructure in the EU. Its objectives include promoting cross-border cooperation and establishing a culture of risk management and prevention.

Read more on the enisa website.

Who Does NIS2 Affect?

NIS2 regulates that companies that fall within the scope of the directive must take appropriate and reasonable technical and organizational measures to effectively counter cyber threats. Moreover, they are required to adopt preventive measures to reduce the impact of security breaches, an obligation relevant for all medium-sized and large organizations. Non-compliance may lead to substantial financial fines and damage to reputation.

The NIS2 directive applies to a wide range of organizations and companies, including critical infrastructure operators, digital service providers and public administrations. It covers multiple sectors vital to the EU’s digital stability and welfare, including energy, transportation and traffic, drinking water, wastewater, telecommunications, banking and healthcare. To address cybersecurity threats, minimize vulnerabilities, and improve digital resilience, these entities are required to comply with the strict standards and practices established by the NIS2 directive.

Under the currently proposed German draft implementation law, nearly 30,000 companies in Germany will be required to take additional cybersecurity measures, and there will be increased oversight by the Federal Office for Information Security (BSI) with a three-tiered reporting system for security incidents.

More information about critical infrastructure.