NIS 2 penalties

By October, France must transpose the European NIS 2 Directive (Network and Information Security 2), which strengthens NIS, a directive adopted six years earlier. The new text goes further on several levels: more sectors concerned, a wider scope and, finally, tougher penalties. But what do the organisations concerned risk if they fail to comply with the requirements of NIS 2?

To strongly encourage organisations to meet the requirements of the directive, the text provides for new penalties. They will be heavier than in the first version of the text, the aim being to move from a best-efforts approach to a regulatory and legal obligation.

Three main categories of penalties stand out:

• Breaches made public
• Substantial fines
• Management held accountable

First, one set of penalties provides for publicly naming organisations that fail to comply with the requirements of the law. More specifically, the competent national authorities will make the non-compliance of the organisations concerned public. Going further still, they will be able to publicly identify, through statements, the natural and legal persons responsible for the non-compliance.

In addition, fines could be much heavier than those provided for by NIS 1. They can now reach €10 million or 2% of turnover for essential entities. As we will see in the second part of this article, the amount of these fines depends on the type of entity concerned.

Finally, the directive emphasises the legal liability of management, to make sure these cybersecurity requirements are taken seriously. Company executives, as well as public officials and elected representatives, may therefore be held liable for failing in their obligation to ensure compliance with the directive.

While penalties will be heavier for all organisations covered by the directive, the measures will differ. The new European directive distinguishes between two types of entities, essential entities and important entities, which will not be affected by NIS 2 in the same way.

As explained in our previous blog post, essential and important entities differ by size and sector. The minimum requirements are the same for both types of entities, but the form of supervision and the penalties vary. Supervision refers to the measures and checks put in place by the competent authorities: continuous monitoring, audits and compliance reports.

In terms of supervision and how strict the checks are:

• essential entities will have to meet the supervision requirements as soon as NIS 2 comes into force and may be inspected at any time;
• important entities will be subject to ex post supervision, meaning the authorities will step in if they receive evidence of non-compliance.

Financial penalties are differentiated too:

• essential entities may face fines of up to €10 million or 2% of their turnover;
• important entities may face fines of up to €7 million or 1.4% of their turnover.

NIS 2 is a European directive: each country must transpose the text into its own law, and each country is responsible for enforcing that law. In France, ANSSI, the National Cybersecurity Agency of France, which is responsible for protecting the nation against cyberattacks, will be in charge of supervision and of applying NIS 2 penalties.

As it points out on its website, ANSSI will be able to identify cases of non-compliance and carry out inspections that may lead to penalties. To that end, the agency is currently defining supervision mechanisms suited to the change of scale that NIS 2 represents.

ANSSI's role is not limited to enforcing penalties: it also supports organisations. It has already launched a beta version of a digital portal called “MonEspaceNIS2”, designed to make its interactions with regulated entities easier. In addition to the solutions available on the market, companies will therefore be supported by a specialised public body on their path to compliance. ANSSI intends to help companies through three main channels:

• Advisory actions
• Awareness-raising
• Operational assistance