The aim of NIS2 is simple yet profound: to create a resilient digital environment across Europe by improving the cybersecurity capabilities of essential and important entities. By setting clear standards for cybersecurity governance, incident reporting, risk management, and cross-border collaboration, the directive strives to mitigate the risks posed by cyber threats. 

Under the NIS2 Directive, the scope of affected entities has expanded considerably compared to the original NIS Directive. Now, more sectors and types of organizations are subject to its requirements. These include: 

• Critical Infrastructure Providers: Entities in sectors such as energy, transport, banking and healthcare. These industries are increasingly targeted by cybercriminals due to their importance in maintaining the functioning of society. 
• Digital Service Providers: This includes cloud services, online marketplaces, and search engines. As businesses continue to move operations online, the cybersecurity of these digital infrastructures becomes more vital than ever.
• Public Administration Bodies: Governments and governmental bodies at national and local levels also fall under the directive. 

The directive also places an emphasis on supply chains, recognizing that cybersecurity vulnerabilities in one entity can have a cascading effect on others. This interconnected approach encourages organizations to not only focus on their own defenses but to also ensure their partners and suppliers maintain high cybersecurity standards. 

The NIS2 Directive lays down a comprehensive framework for improving cybersecurity across Europe. Key provisions include: 

1. Cybersecurity Risk Management Measures 

NIS2 requires organizations to adopt a risk-based approach to cybersecurity. This involves identifying, assessing, and mitigating risks in a systematic manner. Entities are also expected to establish clear internal governance structures for managing cybersecurity and to implement incident response plans to swiftly address breaches when they occur. 

2. Incident Reporting 

NIS2 enhances the requirement for reporting cybersecurity incidents. Organizations must now report significant security incidents to the relevant authorities within 24 hours of detection. This rapid reporting is essential in ensuring that threats are identified early and mitigated before they cause widespread damage. 

3. Supply Chain Security 

The directive places significant emphasis on securing supply chains. Given the growing complexity and interdependency of global supply chains, NIS2 mandates that organizations assess and manage the cybersecurity risks posed by third-party suppliers and partners. This is an attempt to close the often-overlooked vulnerabilities in the supply chain that can be exploited by cybercriminals. 

4. Stronger Enforcement and Penalties 

Different than the initial NIS Directive, NIS2 is less voluntary and will impose financial penalties similar to those of GDPR and DORA. NIS2 introduces stronger enforcement mechanisms. Member states must establish clear national cybersecurity authorities with the power to impose fines and sanctions on organizations that fail to comply with the directive. These penalties can be steep—up to 2% of a company’s annual turnover—emphasizing the importance of adhering to the cybersecurity standards set forth in the directive. Additionally, there are possible implications for c-level executives that fail to comply with the directive.  

5. Enhanced Cooperation 

NIS2 facilitates cross-border cooperation and information sharing between member states. By strengthening the EU’s collective response to cyber threats, the directive ensures that member states can share best practices, conduct joint cybersecurity exercises, and respond swiftly to incidents that may affect multiple countries.