What is the NIS2 directive?

The NIS2-directive is an update and expansion of the NIS-directive. Its purpose is to strengthen cybersecurity in the EU, and it aims to increase resilience and response to cyber threats across vital sectors and digital services.

What does the NIS2 mean?

NIS2 stands for Network and Information Systems Directive 2 and introduces stricter security requirements and reporting obligations for a broader range of companies than the original NIS. This includes essential service providers and digital platforms. It is up to each member state country to refine and implement the directive into their respective national legislation.

Who is covered by the NIS2 directive?

The expansion covers several sectors including energy, transport, banking, healthcare, digital infrastructures, public administration, as well as providers of public digital services and essential digital platforms e.g. social networks and cloud services. Note that as a subcontractor to these industries, you may also be subject to the directive's requirements.

Sector	Sub Sectors	Large +250 or > 50 mio. €	Medium 50-249 or > 10 mio. €	Small Less than 50 employess
Energy	Electricity, District Heating and District Cooling, Oil, Gas, Hydrogen	Essential	Important	Not covered
Transport	Air, Rail, Water, Road	Essential	Important	Not covered
Banking Sector	Credit Institutions	Essential	Important	Not covered
Financial Market Infrastructures	Marketplaces	Essential	Important	Not covered
Healthcare	Healthcare Providers; EU Reference Laboratories; Research and Development (R&D) in Pharmaceuticals; Manufacture of Basic Pharmaceutical Products and Preparations; Manufacture of Medical Devices	Essential	Important	Not covered
Drinkingwater		Essential	Important	Not covered
Wastewater	Only if it is a substantial part of their service	Essential	Important	Not covered
Digital infrastructure	DNS Service Providers, Cloud Services, Data Centers, Content Delivery, Internet Exchange Points, Non-Qualified Trust Service Providers, Top-Level Domain (TLD) Name Providers, Communication Networks	Essential	Essential/ Important (based on Sub Sectors)*	Essential/ Important (based on Sub Sectors)*
Information and Communication Technology (ICT) Providers	Managed service providers, managed security service providers	Essential	Important	Not covered
Public Administration	(excluding Parliament, Courts, and the Central Bank)	Essential (central)* Important (regional)	Essential (central)* Important (regional)	Essential (central)* Important (regional)
Space	Operators of Ground-Based Infrastructure	Essential	Important	Not covered
Postal and Courier Services	Electricity, District Heating and District Cooling, Oil, Gas, Hydrogen	Important	Important	Not covered
Waste Management	Waste management must be the primary purpose	Important	Important	Not covered
Chemicals	Production, Manufacturing, Distribution	Important	Important	Not covered
Food	Wholesale Production and Industrial Production and Processing	Important	Important	Not covered
Manufacturing	Medical Devices; Computer, Electronic and Optical Products; Electrical Equipment; Machinery; Motor Vehicles, Trailers, Semi-Trailers; Other Transport Equipment	Important	Important	Not covered
Digital Providers	Online Marketplaces, search engines, social media platforms	Important	Important	Not covered
Research	Research Organisations (Optional for Member States: Educational Institutions)	Important	Important	Not covered

DO YOU WANT TO KNOW MORE? CONTACT US OR REQUEST A CALL