Navigating the New Era of Cybersecurity: A Closer Look at the NIS2 Directive

Cybersecurity is not a buzzword. Its importance has never been more real. As digital threats grow in number and complexity, robust and efficient cybersecurity regulations are critical. Now we have a new playing field: the NIS2 Directive , a significant update to the original NIS, aimed at strengthening cybersecurity across the European Union (EU).

In this article, we'll break down the key aspects of NIS2: what's changed, who needs to comply, and what actions organizations should take.

Why NIS2? Wasn't NIS1 Enough?

The original NIS Directive, established in 2016, laid the foundation for network and information security across the EU. However, as technology advanced, so did cyber threats, necessitating an upgrade. NIS2 expands upon its predecessor with more stringent and specific measures, addressing the current cybersecurity landscape.

What’s New in NIS2?

• Broader Scope: While NIS1 focused on key sectors (energy, transport, banking), NIS2 includes additional sectors like postal services, waste management, online marketplaces, and social networks.
• Enhanced Requirements: NIS2 mandates more detailed security practices such as multi-factor authentication (MFA), encryption, and continuous monitoring—moving from a general framework to a more targeted approach.

The Three Pillars of NIS2:

• Cybersecurity measures: Expands across the initial 7 sectors and beyond.
• Preparedness: Member States must adopt stricter oversight (national cyber strategies, establishing a Cybersecurity Incident Response Team-CSIRT).
• Cooperation: New reporting and information-sharing mechanisms are introduced.

Who Needs to Comply?

NIS2 applies to a broader range of sectors, dividing entities into two categories: Essential and Important. Here’s a quick comparison:

In short, if your organization provides critical societal functions or digital services, NIS2’s requirements apply to you. For companies operating across multiple EU countries, the directive clarifies compliance based on where the majority of operations or cybersecurity decisions take place.

Key Obligations Under NIS2

1. Governance (Article 20)

Organizations must ensure their management approves and oversees cybersecurity risk management measures. Management bodies are also held accountable for any infringements and must undergo regular cybersecurity training, extending this to their employees.

2. Cybersecurity Risk Management (Article 21)

Organizations must implement proportionate technical, operational, and organizational measures based on their size, exposure to risks, and the potential societal impact of incidents. This includes preparing for a broad spectrum of threats, from natural disasters to cyberattacks.

3. Incident Reporting (Article 23)

Significant incidents must be reported within 24 hours to the relevant authority (CSIRT or other competent body). In some cases, organizations must notify affected service recipients about potential threats or available remedies.

4. Use of European Cybersecurity Certification (Article 24)

Organizations may need to use certified ICT products, services, or processes under European cybersecurity schemes to meet the directive’s security obligations. Member States are encouraged to promote qualified trust services.

Compliance Duties

Organizations under NIS2 have several responsibilities:

• Duty of Care: Conduct risk assessments and implement measures to maintain continuity and protect data.
• Duty to Report: Report significant incidents, including cyber incidents, to authorities within 24 hours.
• Supervision: Entities will be monitored for compliance, and supervisory bodies will assess adherence to the directive’s obligations.

Preparation Tips: How Can You Get Ready?

If you think cybersecurity is solely management team’s responsibility, it's time to embrace a modern approach. Effective cybersecurity requires everyone's involvement, as social engineering remains the top attack vector, affecting all levels of an organization.

Even though national legislations aren’t finalized, organizations can begin preparing by enhancing their cybersecurity frameworks through measures like:

• Establishing policies for incident handling, access control, and supply chain security.
• Business continuity plans and backup strategies.
• Monitoring and logging: Implement processes to detect, respond to, and log security events.
• Employee training: Raise awareness of cybersecurity best practices and risks.

NIS2 Implementation Timeline

National Implementations:

• Germany: NIS2 will be transposed into national law (NIS2UmsuCG) by late 2024, affecting at least 30.000 companies.
• Netherlands: Implementation is expected by the end of 2024.
• Belgium: Essential and Important entities must register with the Center for Cybersecurity Belgium (CCB) by October 2024, with self-assessments verified by 2026.

How EasyLife 365 Can Help with NIS2 Compliance

As organizations navigate the significant changes brought by NIS2, EasyLife 365 emerges as a trusted solution partner for meeting cybersecurity and compliance requirements. With ISO 27001 and ISO 27017 certifications and Microsoft-certified products, we provide a secure collaboration environment that significantly reduces the risk of cyber incidents.

NIS2 emphasizes vigilance around insider threats, access controls, and employee awareness of security risks. It mandates organizations to implement systems that regularly report on network and information security directly to management, ensuring updates and independent reviews are conducted by qualified auditors.

EasyLife 365’s governance management solutions make compliance and audit simple. With seamless user management, from onboarding to cleanup, and automated policies that maintain continuous governance, we help organizations mitigate risks while upholding the highest security standards.

Want to learn more? Explore our solutions or get in touch with us today.

Sources:

• KPMG - NIS2 Directive Overview
• European Commission - Cybersecurity Risk Management Reporting Obligations
• CSA Blog - European Approach to Cybersecurity
• NIS-2 Directive Website