NIS2 (Directive (EU) 2022/2555) replaced the original NIS Directive and extends cyber security obligations to many more sectors and organisations across the EU. Member States were required to transpose it into national law by October 2024.
Does It Apply to You?
NIS2 covers entities in sectors such as energy, transport, banking, health, digital infrastructure, ICT service management and a range of other critical and important sectors. Size thresholds usually apply, but some organisations are covered regardless of size.
Even if you are not directly in scope, your clients may be, and they will increasingly expect suppliers to meet similar standards. Check the latest national guidance and your legal advisors for your specific position.
What It Expects
The directive focuses on risk management and accountability, including:
- Risk analysis and information security policies
- Incident handling and reporting
- Business continuity, backups and crisis management
- Supply chain security
- Access control, multifactor authentication and encryption
- Staff training and management oversight
A Sensible First Step
Run a gap assessment against these areas. Most organisations already have some controls in place and need to formalise, document and fill the gaps.
Contact me for a structured NIS2 readiness review.