From NIS to NIS 2

NIS 2, or Network and Information Security 2, is the new version of the European directive aimed at strengthening the security of networks and information systems within the member states of the European Union, adopted on 10 November 2022.

A. What is a directive?

First of all, it is important to stress that NIS 2 is a directive and not a regulation. A regulation is meant to be uniform across countries and applies directly as soon as it has been adopted by the Council of the EU or the European Parliament and published in the Official Journal of the EU. The purpose of a directive, on the other hand, such as NIS 2 or Network and Information Security, version 2, is to promote the harmonisation of national laws by setting out general principles and objectives, while leaving member states a certain degree of freedom in how they apply the text. Each state is free to go beyond these principles. The directive must be transposed into national law through a vote in national parliaments, within the set deadlines. (1)

B. Background: the NIS Directive and its evolution into NIS 2

C. Why protecting networks and information systems matters

This increased interconnectivity means that attacks and security flaws spread faster and more widely, endangering critical infrastructure, sensitive data and information systems across the European Union.

Faced with this reality, it is imperative that member states work together to ensure:

• adequate security conditions throughout the European Union;
• the identification of common vulnerabilities;
• the sharing of information on threats;
• the implementation of effective prevention and response measures.

For example, in February 2022, the European Union suffered a cyberattack on the KA-SAT satellite network, and then accused Russia of being behind it. (2) The attack deprived businesses, public institutions and also civilians of internet access. “This unacceptable cyberattack is a further example of the irresponsible activities Russia is conducting in cyberspace, and an essential component of its illegal and unjustified invasion of Ukraine,” the EU declared. (3)

A. Objectives of NIS 1

The main objective of NIS 1, introduced in 2016, was to raise the overall level of cybersecurity and cyber resilience within the European Union (4). To achieve this, the aim was to:

• create consistency in cybersecurity across member states, making sure they are properly protected against cyber threats and can benefit from other countries' best practices;
• optimise communication and information sharing while raising their awareness, in order to strengthen the collective capacity to counter attacks;
• enable some more advanced countries to promote a culture of cybersecurity, by leading by example and highlighting the importance of taking this dimension into account.

NIS 1 was therefore a strategy of collaboration and cooperation between EU member states. Some more advanced countries played a role in promoting a culture of cybersecurity, by leading by example and highlighting the importance of taking this dimension into account.

B. Overview of the main elements of the NIS 1 Directive

When the NIS Directive was introduced, two specific sectors were covered: operators of essential services (hereinafter “OES”) and digital service providers (hereinafter “DSP”).

OES (5) are entities operating in essential sectors such as energy, transport, health, banking, financial services and critical digital infrastructure. These operators are subject to stricter security obligations because of the importance of their services to the proper functioning of society and the economy.

By contrast, DSPs (6) cover a broader range of digital services, such as online services, cloud computing services, electronic payment services, search engines, online marketplaces, etc.

DSPs are subject to security requirements proportionate to the nature and importance of the digital services they provide.

The introduction of NIS (the directive on the security of network and information systems) improved and consolidated the overall level of cybersecurity across Europe by helping to:

• reduce the risk of cyberattacks;
• better protect essential infrastructure and sensitive data;
• raise awareness of the importance of cybercrime issues;
• develop greater digital sovereignty.

The consultancy Wavestone carried out a study covering the 27 countries of the European Union plus Switzerland and the United Kingdom; 79% of these states had put in place a state supervision process. In addition, the directive established common security requirements, which makes cooperation and coordination between EU member states easier and makes these standards consistent. (7)

The directive provided for the creation of three entities:

On 17 June 2022, the Council of the European Union and the European Parliament jointly published the draft revision of NIS, prompted by its limitations, which included:

• a scope that was too narrow regarding the sectors required to comply with the directive;
• countries had too much freedom in implementing the directive at national level, which led to inconsistent application across Europe.

To address these problems, NIS 2 was developed with significant improvements and a broader scope, including:

These measures aim to ensure better coordination, a more effective response to cybersecurity incidents and stronger protection against cyber threats. NIS 2 seeks to establish more consistent cybersecurity standards across the European Union, thereby encouraging a collaborative approach and robust protection of networks and information systems.

The NIS 2 Directive also sets out two types of penalties (11) to ensure that cybersecurity obligations are met:

NIS 2 introduces new players and criteria in order to optimise this directive and strengthen European cybersecurity. The previous definitions of operators of essential services (“OES”) (12) and digital service providers (“DSP”) are replaced respectively by the terms “essential entity” (hereinafter “EE”) and “important entity” (hereinafter “IE”), in order to adapt obligations to each entity.

To fall within the scope of the NIS 2 Directive, you must be a public or private entity, provide services or operate within the European Union, and your business sector must be included in the list of EEs or IEs. In addition, you must have at least 50 employees and annual turnover of €10 million or more. (13)

A. Implementation timeline of the NIS 2 Directive

The NIS 2 Directive was published in the Official Journal of the European Union on 27 December 2022, and member states have 21 months from that date to transpose the directive into their national law. The transposition deadline is therefore set for October 2024.

However, it is important to stress that this deadline concerns transposition into national law by member states, not the compliance date for the entities subject to the NIS 2 Directive. These entities will very probably be given additional time to comply with the directive once it applies in their respective countries. (14)

B. Adaptation and transposition into national legislation

The NIS 2 project is part of the European Union's legislative efforts to regulate the growing importance of digital and IT tools. The NIS 2 Directive is designed in coordination with several other texts (15), namely: