Understanding the NIS2 Directive: What UK and EU Businesses Need to Know

The NIS2 Directive is an updated version of the original Network and Information Security (NIS) Directive, adopted by the European Union in 2022 to address evolving cybersecurity risks. The directive aims to strengthen the security and resilience of critical infrastructure across the EU by imposing stricter security obligations on organisations in key sectors. NIS2 introduces broader scope, more comprehensive requirements, and stricter enforcement measures, with penalties for non-compliance that can significantly impact businesses.

This article explores the key elements of NIS2, its applicability to businesses in the UK and EU, and the measures organisations must take to ensure compliance.

1. What is the NIS2 Directive?

The NIS2 Directive (Directive (EU) 2022/2555) was introduced to improve the resilience of essential and important services within the EU by enhancing cybersecurity practices. It builds on the original NIS Directive (2016), which was the EU’s first cybersecurity law, by addressing new threats and regulatory gaps identified since its implementation.

NIS2 aims to create a common high-level framework across member states by standardising cybersecurity requirements, reporting obligations, and enforcement mechanisms.

2. Objectives of NIS2

The primary objectives of NIS2 are to:

• Strengthen the security of critical infrastructure and essential services across the EU.

• Enhance incident reporting and response capabilities.

• Promote a harmonised approach to cybersecurity regulations across member states.

• Improve cooperation between national authorities, including the sharing of threat intelligence and best practices.

3. Key Changes Introduced by NIS2

The NIS2 Directive introduces several significant changes and enhancements compared to its predecessor:

3.1. Expanded Scope

NIS2 significantly broadens the sectors and organisations subject to its requirements. It now applies to two main categories of entities:

1. Essential Entities:
   Organisations providing critical services, such as:

   • Energy (e.g., electricity, gas, oil production)

   • Transport (e.g., rail, air, and shipping)

   • Financial services (e.g., banks and insurance providers)

   • Healthcare (e.g., hospitals, pharmaceutical manufacturers)

   • Digital infrastructure (e.g., data centres, DNS providers)

2. Important Entities:
   Organisations whose operations are vital to economic stability but do not fall under the essential category, such as:

   • Manufacturing of critical goods

   • Research and development organisations

   • Postal and courier services

NIS2 also includes a provision for scalability, allowing member states to identify additional organisations that should be regulated based on their impact on national security.

3.2. Enhanced Security Requirements

NIS2 imposes stricter and more comprehensive cybersecurity measures, including:

• Risk Management:
  Organisations must adopt risk-based security measures to protect their networks and systems from cyber threats.

• Incident Response and Recovery:
  Entities must develop incident response plans, including procedures for handling, reporting, and mitigating the impact of security incidents.

• Supply Chain Security:
  Organisations must assess and manage the cybersecurity risks posed by third-party suppliers and service providers.

• Governance:
  Senior management is now accountable for ensuring compliance, including oversight of cybersecurity measures and reporting obligations.

3.3. Streamlined Reporting Obligations

NIS2 introduces a clearer and more standardised approach to incident reporting. Key requirements include:

• Initial Notification:
  Entities must notify their national authorities within 24 hours of discovering a significant incident.

• Detailed Report:
  A full report must be submitted within 72 hours, including the nature of the incident, its impact, and mitigation measures taken.

• Post-Incident Review:
  Organisations must conduct a review of significant incidents to identify root causes and improve their security measures.

3.4. Harmonised Penalties and Enforcement

Under NIS2, enforcement measures and penalties are more consistent across EU member states. Non-compliant organisations may face:

• Fines of up to €10 million or 2% of annual global turnover, whichever is higher.

• Temporary or permanent bans on operations in severe cases.

• Public disclosure of non-compliance, which can damage an organisation’s reputation.

Additionally, member states must establish independent authorities responsible for monitoring compliance, conducting audits, and imposing penalties.

4. Implications for UK Businesses

Although the UK is no longer part of the EU, NIS2 still has implications for UK-based organisations that provide services to or operate within the EU. These businesses must comply with the directive if they meet certain criteria, such as providing critical services to EU customers or having subsidiaries within EU member states.

The UK’s own NIS Regulations, initially modelled on the original NIS Directive, are expected to be updated to maintain alignment with international cybersecurity standards, including elements of NIS2.

5. Key Compliance Measures for Businesses

To comply with NIS2, organisations must implement several core measures aimed at improving cybersecurity resilience. These include:

5.1. Implementing a Cybersecurity Risk Management Framework

Organisations must develop and maintain a cybersecurity risk management framework that includes:

• Asset Inventory: Identifying critical assets and services.

• Threat Assessment: Analysing potential threats and vulnerabilities.

• Mitigation Measures: Implementing controls to reduce risk (e.g., firewalls, EDR solutions, access management).

5.2. Conducting Regular Vulnerability Assessments

Regular vulnerability assessments and penetration testing are essential to ensure that systems remain secure and compliant. These assessments help organisations identify weaknesses and prioritise remediation efforts.

5.3. Developing Incident Response and Recovery Plans

Organisations must have documented incident response plans that cover:

• Incident detection and containment.

• Escalation procedures and communication protocols.

• Post-incident reviews and continuous improvement measures.

5.4. Managing Third-Party Risks

Supply chain security is a critical focus of NIS2. Organisations must:

• Evaluate the security posture of third-party vendors and suppliers.

• Include security requirements in contracts with external providers.

• Monitor and audit third-party compliance with security policies.

5.5. Training and Awareness

NIS2 requires organisations to promote a culture of cybersecurity awareness. This includes:

• Providing regular security training for employees.

• Ensuring that senior management understands their accountability for cybersecurity governance.

6. Challenges and Best Practices for Compliance

While NIS2 provides a comprehensive framework for cybersecurity, organisations may face several challenges, including:

Challenge 1: Complexity in aligning multiple regulatory frameworks (e.g., NIS2, GDPR, DORA).
Solution: Implement an integrated compliance programme to streamline security and data protection measures.

Challenge 2: Limited resources for cybersecurity improvements.
Solution: Prioritise high-impact areas, such as critical infrastructure, incident response, and vulnerability management.

Challenge 3: Managing third-party risks.
Solution: Establish a third-party risk management programme that includes regular audits and risk assessments.

7. Conclusion

The NIS2 Directive represents a significant step forward in improving the cybersecurity posture of critical infrastructure and essential services across the EU. Businesses must understand their obligations under NIS2 and take proactive steps to enhance their security measures, including risk management, incident response, and third-party oversight. By adopting a structured approach to compliance, organisations can reduce their exposure to cyber threats, avoid penalties, and protect their reputation.

For assistance with NIS2 compliance, including vulnerability management and audit preparation, contact our security experts today.