NIS2: The EU’s new cyber security legislation

What is NIS2?

The Network and Information Systems Directive (NIS2) is a new European Union (EU) legislation aimed at strengthening the cyber security of critical infrastructure providers and digital service providers. The directive aims to ensure that these entities take the necessary measures to prevent and manage cyber security incidents. 

Which industries need to comply with NIS2?

NIS2 builds upon the first NIS directive, which was adopted in 2016. The original directive established a set of requirements for the cyber security of operators of essential services in critical sectors, such as energy, transport, healthcare, and finance. NIS2 extends the scope of the directive to include digital service providers, such as cloud service providers, search engines, and online marketplaces. 

The directive mandates that critical infrastructure providers and digital service providers must take adequate measures to manage cyber security risks and prevent cyber security incidents. They are required to implement robust cyber security strategies, including risk management, incident management, and business continuity plans. 

NIS2 also requires these entities to report significant cyber security incidents to competent authorities within 24 hours of detection. The competent authorities are responsible for enforcing the NIS2 directive in their respective countries and ensuring compliance with the requirements. 

One of the key features of NIS2 is the establishment of a European Cybersecurity Competence Centre (ECCC) and a European Cybersecurity Industrial, Technology and Research Competence Centre (ECITRC). The ECCC is responsible for developing and promoting cyber security knowledge and expertise across the EU, while the ECITRC is responsible for developing and promoting cyber security technologies and innovation. 

NIS2 is a crucial step in strengthening the cyber security of critical infrastructure providers and digital service providers in the EU. The directive aims to create a more secure and resilient digital environment, which is essential for the functioning of the EU economy and society. 

The challenges

However, compliance with NIS2 can be challenging for many organisations, especially small and medium-sized enterprises (SMEs). SMEs may lack the necessary resources and expertise to implement the required cyber security measures, and they may struggle to report cyber security incidents to competent authorities within the required timeframe. 

To address these challenges, the EU has established a support programme for SMEs called the Cyber Security Competence Centre for SMEs (CC-SME). The programme provides SMEs with access to cyber security expertise, training, and support to help them comply with the NIS2 directive. 

Key takeaways about NIS2

The NIS2 directive is a critical step in improving the cyber security of critical infrastructure providers and digital service providers in the EU. The directive aims to create a more secure and resilient digital environment, which is essential for the functioning of the EU economy and society. However, compliance with the directive can be challenging for many organisations, especially SMEs. The EU’s support programme for SMEs aims to address these challenges by providing them with access to cyber security expertise, training, and support. 

How Grey Matter can help you with cyber security and compliance with NIS2

Grey Matter partners with several leading and niche cyber security software companies that can provide many of the cyber security solutions required to help you comply with NIS2. For instance, we can help you with cyber security training, endpoint detection and response software or managed services, patch management, firewalls and more.  

Our cyber security specialists are on hand to answer any questions you have and are there to ensure you have the right tools and licensing needs to effectively secure your business and comply with regulations. 

Fill in the form below to arrange a call with one of our specialists.