NIS2 DIRECTIVE

NIS2 Definition

The NIS2 Directive (Network and Information Security 2), adopted by the European Union in December 2022, is a major evolution of the NIS Directive (2016). It aims to strengthen the resilience of critical infrastructures against growing cyber threats and to harmonize cybersecurity practices across Member States.

NIS2 broadens the scope of the initial directive by including a greater number of critical sectors and even certain digital service providers. It imposes stricter, more uniform security requirements while establishing reinforced cooperation mechanisms among Member States.

Who is affected by the NIS2 Directive? A closer look at entities and sectors

Over 10,000 entities affected across 18 sectors of activity. The NIS2 Directive broadens its scope compared to the first NIS Directive and now covers a large number of sectors, businesses, and services, divided into two main categories: essential entities (EE) and important entities (IE).

Essential entities covered

These entities provide critical services to society. They are subject to higher security and resilience requirements and are prioritized for NIS2 compliance. The relevant sectors include:

Important entities covered

Important entities are also vital but do not fall directly under so-called critical infrastructure. They include the following sectors:

Other potentially affected entities

Depending on the risks they pose to national security, Member States may designate additional sectors or businesses. This can include critical subcontractors, suppliers, or business partners of the listed sectors.

Entity selection criteria

Companies are selected based on various criteria, in particular:

• Company size: Generally, companies with more than 50 employees or an annual turnover exceeding 10 million euros are targeted, although certain sectors may include small, high-criticality enterprises.
• Potential impact: Any entity whose disruption could have significant effects on national security, public safety, public health, or the economy.
• Interconnection with other critical sectors: Companies that play an important role in supply chains or have critical interconnections with other essential infrastructures.

NIS2 France: Key dates and entry into force

Here are the key milestones of its development and transposition in France:

December 16, 2020: The European Commission proposes a revision of the initial NIS Directive, marking the beginning of discussions on NIS2.

May 13, 2021: The Council of the European Union adopts a general approach to the proposed NIS2 directive, establishing a common position for negotiations with the European Parliament.

November 10, 2022: The European Parliament adopts the NIS2 directive, following negotiations with the Council.

December 27, 2022: Official publication of the NIS2 directive in the Official Journal of the European Union.

January 16, 2023: Entry into force of the NIS2 directive, giving Member States 21 months to transpose it into their national legislation.

October 15, 2024: Presentation to the Council of Ministers of the bill aimed at transposing the NIS2 directive into French law.

October 17, 2024: Deadline set by the European Union for the transposition of the NIS2 directive by Member States.

October 18, 2024: Entry into force of the NIS2 directive at the European level.

Early 2025: Expected adoption of the bill by the French Parliament, formalizing the transposition of the NIS2 directive into national law.

2025-2027: Period during which affected entities must comply with the new obligations imposed by the NIS2 directive, with a three-year grace period granted by ANSSI to achieve full compliance.

It is essential for French businesses and public administrations to prepare now for the requirements of the NIS2 directive to ensure a smooth transition and optimal compliance within the established deadlines.

What are the 3 main obligations under NIS2?

The NIS 2 directive imposes several essential obligations on affected entities to strengthen cybersecurity across the European Union. These obligations are primarily structured around three pillars: information sharing, cyber risk management, and incident reporting.

1. Information sharing

Entities must submit specific information to the competent national authority, namely the French National Cybersecurity Agency (ANSSI). This communication includes registering the entity with ANSSI via the MonEspaceNIS2 portal, notifying cyber incidents, and sharing information on cybersecurity investments.

2. Cyber risk management

Entities are required to implement appropriate legal, technical, and organizational measures to manage risks threatening the security of their network and information systems. These measures cover various aspects, including:

• Risk analysis: regular identification and assessment of potential threats.
• Security policies: development of internal policies to ensure system protection.
• Business continuity: implementation of plans to maintain operations in the event of an incident.
• Incident management: procedures to detect, report, and respond to security incidents.
• Supply chain security: assessment and management of risks associated with suppliers and partners.
• Training and awareness: programs to educate personnel on cybersecurity best practices.

These requirements aim to standardize and strengthen resilience against evolving cyber threats.

3. Incident reporting

Entities must report security incidents with a significant impact to the competent national authority. The NIS 2 directive sets a 24-hour deadline to notify a significant incident after becoming aware of it. This obligation aims to ensure a rapid and coordinated response to cyber threats.

Furthermore, the NIS 2 directive introduces penalties for non-compliance, which can reach up to €10 million or 2% of total worldwide annual turnover for essential entities, and €7 million or 1.4% of total worldwide annual turnover for important entities.

It is therefore crucial for affected entities to prepare now for these new obligations in order to ensure compliance and strengthen their resilience against cyber threats.

Penalties

In accordance with the NIS 2 directive, supervisory actions will be carried out to verify that entities comply with their obligations. Failure to comply with these obligations will expose entities to penalties.

The directive provides the authority to impose, among other measures, financial penalties on regulated entities. These penalties, which must be proportionate to the breach(es), may reach a percentage of the entities' worldwide turnover (2% for essential entities (EE) and 1.4% for important entities (IE)). In addition to financial fines, corrective measures or compliance orders may be issued by the competent national authority.

In the event of repeated violations or serious non-compliance with cybersecurity obligations, authorities may also enforce more severe sanctions, such as the temporary suspension of the relevant services or, in certain cases, the disqualification of executives responsible for cybersecurity management.

These penalties are intended to encourage entities to take their cybersecurity obligations seriously and to strengthen the security of network and information systems across the entire European Union.

NIS 2 Directive: ANSSI's key role in France

The ANSSI (National Cybersecurity Agency of France) plays a pivotal role in the implementation of the NIS 2 directive in France. As the competent authority, it supports essential operators and affected organizations in meeting regulatory requirements, particularly regarding risk management, incident notification, and system resilience. It also provides recommendations and a methodological framework to continuously enhance security. By facilitating the exchange of critical threat and incident intelligence among stakeholders, ANSSI fosters a collaborative approach to cyber threats. Through its expertise and regulatory role, it helps elevate the overall level of cybersecurity while ensuring compliance with the directive's objectives.

How can ITrust support you?

The NIS2 directive thus imposes a set of measures on entities to strengthen the cybersecurity and resilience of their infrastructures. ITrust's solutions are aligned with the requirements of the NIS2 directive, providing comprehensive coverage of the core cybersecurity domains required of organizations. By integrating these solutions, organizations can bolster their resilience against cyber threats and ensure enhanced regulatory compliance.

Here are a few examples of how our solutions map to the requirements: