EU Council adopts NIS2 directive to harmonize cybersecurity across member states

The Council of the European Union (EU) has adopted a new cybersecurity directive designed to improve resilience and incident response capacities across the EU, replacing NIS, the current directive on the security of network and information systems.

The new directive, NIS2, will set the baseline for cybersecurity risk management measures and reporting obligations across sectors and aims to harmonize cybersecurity requirements and implementation of measures in different member states.

NIS2 enhances EU incident management cooperation

“NIS2 will set the baseline for cybersecurity risk management measures and reporting obligations across all sectors that are covered by the directive, such as energy, transport, health and digital infrastructure,” read an EU Council press release.

The revised directive aims to harmonize cybersecurity requirements and measures across member states by establishing minimum rules for a regulatory framework and laying down mechanisms for effective cooperation among relevant authorities, it added. “It updates the list of sectors and activities subject to cybersecurity obligations and provides for remedies and sanctions to ensure enforcement,” the release continued, also citing the creation of the European Cyber Crises Liaison Organization Network (EU-CyCLONe) to support the coordinated management of large-scale cybersecurity incidents and crises.

NIS2 introduces rules to ID regulated entities

NIS2 introduces a new “size-cap rule” for the identification of regulated entities, meaning that all medium-size and large entities operating within the sectors or providing services covered by the directive will fall within its scope, the EU Council stated. “Its text includes additional provisions to ensure proportionality, a higher level of risk management and clear-cut criticality criteria for allowing national authorities to determine further entities covered.”

The text also clarifies that the directive will not apply to entities carrying out activities in areas such as defense or national security, public security, and law enforcement. “Judiciary, parliaments, and central banks are also excluded from the scope.”

NIS2 streamlines reporting obligations

Moreover, the new directive has been aligned with sector-specific legislation, in particular the Digital Operational Resilience Act (DORA) for the financial sector (DORA) and the Center for European Reform (CER) on the resilience of critical entities, to provide legal clarity and ensure coherence between NIS2 and these acts, the EU Council said. “A voluntary peer-learning mechanism will increase mutual trust and learning from good practices and experiences in the Union, thereby contributing to achieving a high common level of cybersecurity.”

The new legislation will also streamline reporting obligations in order to avoid causing over-reporting and creating an excessive burden on the entities covered.

NIS2 is set to be published in the Official Journal of the European Union in the coming days and will enter into force on the 20th day following this publication. Member states will have 21 months from the entry into force of the directive in which to incorporate the provisions into thei