Brussels (Brussels Morning Newspaper) – The EU Commission strives to boost the cybersecurity of the EU’s critical entities and networks.
The European Commission has assumed the first implementing regulations on cybersecurity of critical entities and networks under the Directive on measures for a high common level of cybersecurity across the Union (NIS2 Directive). This implementing act points to cybersecurity risk management measures as well as the cases in which an incident should be considered important and companies providing digital infrastructures and services should convey it to national authorities.Â
What sectors are impacted by new cybersecurity rules?
As reported by the Commission, the implementing law adopted will apply to specific classifications of companies providing digital services, such as cloud computing service providers, data centre service providers, online marketplaces, online search engines and social networking platforms, to name a few. For each type of service provider, the implementing act determines when an incident is considered noteworthy, to whom it needs to be informed and in which timeframe.
How are digital service providers affected by the NIS2 Directive?
The foremost EU-wide law on cybersecurity, the NIS Directive, came into existence in 2016 and helped to acquire a common level of security of network and information systems across the EU. As part of its fundamental policy objective to make Europe fit for the digital age, the Commission submitted the revision of the NIS Directive in December 2020. After entering into force in January 2023, Member States had to transpose the NIS2 Directive into national law by 17 October 2024.
The NIS2 Directive seeks to ensure a high level of cybersecurity across the Union. It covers entities working in sectors that are critical for the economy and society, including providers of public electronic communications services, ICT service management, digital services, wastewater and waste management, space, health, energy, transport, manufacturing of critical products, postal and courier services and public administration.
What cybersecurity measures are enforced on critical EU entities?
The Directive supports security requirements inflicted on the companies and addresses the security of supply chains and supplier connections. It simplifies reporting obligations, introduces more rigorous supervisory measures for national authorities, as well as more rigorous enforcement requirements, and desires to harmonise sanctions regimes across Member States. It will help improve information sharing and collaboration on cyber crisis management at a national and EU level.
