Transitioning from NIS1 to NIS2: Preparing for Enhanced Cybersecurity Standards

Introduction

The Network and Information Systems (NIS) Directive has been pivotal in setting baseline cybersecurity standards across critical sectors in the EU. However, as cyber threats evolve and digital interconnectivity grows, the original NIS1 framework has proven insufficient for today’s complex cyber landscape. Enter NIS2 directive a strengthened  design to address emerging vulnerabilities, expand regulatory scope, and enforce stricter compliance requirements. Covering a broader array of industries and introducing more rigorous obligations, NIS2 aims to enhance cybersecurity resilience across sectors essential to economic stability and public safety. This article delves into what NIS2 means for organisations, highlighting key changes, compliance obligations, and preparation steps to ensure readiness.

 

1. Background: From NIS1 to NIS2

The Network and Information Systems (NIS) Directive was initially introduced in 2016 to establish cybersecurity and resilience standards for essential services and digital service providers within the EU. However, with the rise in cyber threats and the digital interdependence between sectors, NIS1 needed enhancement. NIS2, which supersedes NIS1, has been crafted to improve cybersecurity across an expanded array of industries, addressing new threats and plugging existing regulatory gaps. The directive broadens the scope, imposes more stringent compliance measures, and mandates better cyber-resilience planning for covered organisations.

 

2. Which Industries Are Covered?

One of the significant shifts from NIS1 to NIS2 is the expansion of industries under regulatory coverage. Under NIS1, only essential sectors, such as energy, transport, water, healthcare, and digital infrastructure, were required to comply. NIS2 extends this scope to include additional industries, particularly those vital to modern economies and societal functions, including:

• Financial Services: Banks, insurance companies, and financial market infrastructure.
• Food Supply Chains: Entities involved in food production, processing, and distribution.
• Waste Management: Firms involved in waste treatment, disposal, and recycling.
• Research and Development: Organisations dedicated to advancing technology, particularly in digital infrastructure and innovation sectors.
• Postal and Courier Services: Logistics and postal providers crucial for supply chain operations.

By covering a wider array of sectors the  NIS2 directive ensures that industries interwoven with economic stability and public safety are subject to enhanced cybersecurity standards, addressing evolving threats and enhancing resilience.

 

3. Key Implications for Covered Organisations

NIS2 introduces stringent standards that significantly impact how organisations manage cybersecurity risks:

• Broader Accountability: NIS2 requires organisations to demonstrate an executive commitment to cybersecurity, ensuring board members have an active role in risk management. This obligation places senior leadership directly accountable for the organisation’s compliance.
• Increased Reporting Obligations: Organisations now have stricter timelines for reporting incidents. Under NIS2, they must notify authorities of any substantial cyber event within 24 hours of detection, followed by a detailed report within 72 hours.
• Stronger Supply Chain Requirements: NIS2 mandates that organisations evaluate and secure their supply chains, requiring due diligence when contracting third-party providers to reduce potential cyber risks associated with suppliers.
• Greater Risk Management Mandates: With more detailed risk management protocols, organisations must regularly update their security measures, establish incident response protocols, and invest in system resilience.

 

4. Core Compliance Obligations for Covered Organisations

Meeting NIS2 requirements entails an integrated approach to cybersecurity and resilience. Key compliance obligations include:

• Incident Reporting: As noted, incidents must be reported within 24 hours of detection. Rapid reporting ensures that authorities can act promptly, reducing potential widespread damage.
• Security Measures: Organisations must maintain a robust security framework, including risk assessment and mitigation measures, employee training, and threat detection capabilities.
• Business Continuity Plans: Companies are required to develop and test business continuity and crisis management plans to ensure operations can continue in the face of disruption.
• Board-Level Accountability: As cybersecurity becomes a boardroom priority, NIS2 mandates that senior management oversee and be held accountable for compliance, which may include regular briefings on risk and exposure levels.

 

5. Steps to Take in Preparation for the  NIS2 Directive

Organisations should consider the following steps to ensure they’re prepared for the NIS2 Directive’s requirements:

1. Conduct a NIS2 Readiness Assessment: Evaluate current cybersecurity measures, incident response protocols, and supply chain vulnerabilities to identify areas for improvement.
2. Establish Governance and Accountability: Implement a cybersecurity governance structure that includes board-level oversight, ensuring all leadership members are informed and committed to compliance.
3. Develop an Incident Response Plan: Review and refine incident response protocols to meet the 24-hour reporting mandate. Invest in detection technologies and conduct regular incident response drills.
4. Strengthen Supply Chain Security: Perform due diligence on third-party providers, ensuring they meet minimum security requirements. This involves setting clear cybersecurity expectations for suppliers and regularly auditing compliance.
5. Enhance Training and Awareness: Provide regular cybersecurity training for employees, focusing on threat awareness, response actions, and reporting procedures.
6. Implement Continuous Monitoring and Testing: NIS2 compliance requires ongoing monitoring of cybersecurity measures and regular system testing to identify and address potential vulnerabilities.

 

6. Fines for Non-Compliance with the NIS2 Directive

The financial repercussions for failing to comply with NIS2 directives are substantial. Under NIS2, penalties are harmonised across the EU, with fines ranging up to 10 million euros or 2% of global annual turnover, whichever is higher. This penalty structure aligns with the GDPR, making it clear that non-compliance with NIS2 is financially and operationally risky. These fines underscore the EU’s commitment to enforcing cybersecurity standards, encouraging covered organisations to implement effective security measures.

 

Conclusion

The transition from NIS1 to NIS2 marks a critical evolution in cybersecurity regulation, expanding industry scope, deepening compliance obligations, and introducing significant penalties. For organisations within the covered sectors, NIS2 compliance is not just a legal requirement but a vital framework for safeguarding operations, reputation, and customer trust in an increasingly interconnected digital world. Proactively preparing for NIS2 ensures organisations not only avoid penalties but also strengthen their cybersecurity posture to address evolving threats.

With NIS2 compliance becoming essential, Formiti Data International offers expert guidance to navigate these complex requirements. We provide support for implementing readiness assessments, incident response planning, and supply chain security, positioning organisations for effective and sustained compliance.