NIS2: what the directive is

In short

NIS2 replaces the first NIS Directive of 2016 and greatly widens its scope: it no longer concerns only a few operators of essential services, but thousands of medium-sized and large companies in 18 sectors, plus some entities included regardless of size. In Italy the competent national authority is the Agenzia per la Cybersicurezza Nazionale (ACN, Italy's National Cybersecurity Agency), and incident notifications go to CSIRT Italia, the national computer security incident response team.

Who must comply

The sectors are listed in two annexes: sectors of high criticality (for example energy, transport, banking, health, water, digital infrastructure, ICT service management, public administration, space) and other critical sectors (for example postal services, waste, chemicals, food, manufacture of medical devices, machinery, vehicles and electronics, digital providers, research). As a rule, medium-sized and large companies fall within scope; some categories are included regardless of size. Entities are divided into essential and important, with similar obligations but different supervision and fines. The companies concerned must register on the ACN platform and update their details every year. To find out whether it applies to you, read the guide NIS2: who must comply.

What it requires

• Risk management measures (Article 21 of the directive): risk analysis and security policies, incident handling, business continuity and backups, supply chain security, vulnerability management, assessment of the effectiveness of the measures, cyber hygiene and training, cryptography, personnel security and access control, multi-factor authentication.
• Notification of significant incidents: early warning within 24 hours, notification within 72 hours, final report within one month.
• Accountability of management bodies, which approve the measures, oversee their implementation, are answerable for them and must undergo training.

Fines reach up to 10 million euros or 2% of total worldwide annual turnover for essential entities, and up to 7 million or 1.4% for important entities. ACN has set out the detailed obligations in its own determinations, together with a step-by-step path to compliance.

Example

A food company with 120 employees finds out that it is an important entity. It registers on the ACN platform, appoints its point of contact, carries out a self-assessment against the required measures and uncovers the main gaps: no procedure for notifying incidents, suppliers never qualified, no MFA on email. The compliance plan starts from there, with the approval of the board of directors. See also NIS2 compliance.

Related terms

• CSIRT
• Supply chain attack
• Residual risk
• Data breach