NIS2

The NIS2 Directive (Directive (EU) 2022/2555).

1. Category

1. Category

1.1. Chapter I: General Provisions

Chapter I sets the foundation for the Directive by outlining its purpose, scope, and key definitions. It establishes the Directive's aim to enhance cybersecurity across the EU by setting common standards and measures. The definitions provided are crucial for ensuring a unified understanding of terms and concepts used throughout the Directive, ensuring consistency in implementation across Member States.

1.1.1. Article 1: Subject Matter and Objectives

Article 1 outlines the primary aim of the Directive, which is to achieve a high common level of cybersecurity across the European Union. It details the framework for enhancing the overall security and resilience of network and information systems.

1.1.2. Article 2: Scope

Defines the entities to which the Directive applies, including both public and private sectors, and specifies the criteria for inclusion, such as medium-sized enterprises and certain critical sectors regardless of size.

1.1.3. Article 3: Definitions

Provides precise definitions for key terms used throughout the Directive, such as cybersecurity, incident, network and information systems, and critical entities.

1.2. Chapter II: National Cybersecurity Frameworks

Chapter II focuses on the internal frameworks that Member States must establish to enhance cybersecurity. It mandates the development of national cybersecurity strategies, specifying governance structures and the roles of various national authorities. The chapter emphasizes the need for coordinated efforts and clear responsibilities to manage cybersecurity risks effectively. The strategies should include measures for risk management, incident reporting, and continuous monitoring to adapt to evolving cyber threats.

1.2.1. Article 4: National Cybersecurity Strategies

Mandates Member States to develop, implement, and maintain a national cybersecurity strategy. This strategy must address risk management, incident reporting, and the roles and responsibilities of different stakeholders.

1.2.2. Article 5: Governance

Describes the establishment of governance structures within Member States, ensuring effective coordination and communication between various national authorities responsible for cybersecurity.

1.2.3. Article 6: Role of National Authorities and Single Points of Contact

Obliges Member States to designate competent authorities and single points of contact (SPOCs) for cybersecurity to streamline efforts and ensure efficient incident handling and information sharing.

1.2.4. Article 7: Cybersecurity Strategies Implementation and Monitoring

Focuses on the implementation and continuous monitoring of national cybersecurity strategies, ensuring they remain effective and adapt to evolving cyber threats.

1.3. Chapter III: Risk Management and Incident Reporting

Chapter III is dedicated to the operational aspects of cybersecurity management. It prescribes detailed requirements for risk management and incident reporting for entities. These measures are designed to ensure that entities are proactive in identifying and mitigating cybersecurity risks. Additionally, it establishes protocols for reporting significant incidents, thereby facilitating a coordinated and timely response to cyber threats. The chapter also outlines specific security requirements that entities must implement to protect their networks and information systems.

1.3.1. Article 8: Risk Management Measures

Requires entities to adopt and implement comprehensive risk management practices to mitigate potential cybersecurity threats and vulnerabilities.

1.3.2. Article 9: Reporting Obligations

Outlines the obligations for entities to report significant incidents to the relevant national authorities promptly. This aims to facilitate a rapid response and limit the impact of such incidents.

1.3.3. Article 10: Handling of Incidents

Details the procedures for managing reported incidents, including investigation, remediation, and communication strategies to inform affected stakeholders and the public when necessary.

1.3.4. Article 11: Security Requirements for Entities

Specifies the security measures that entities must implement, including technical and organizational measures to protect network and information systems.

1.3.5. Article 12: Notification Process

Defines the process for notifying the relevant authorities about incidents, including the required content of such notifications and the timelines for reporting.

1.4. Chapter IV: Cooperation and Information Exchange

Chapter IV highlights the importance of collaboration at both national and Union levels. It establishes the Cooperation Group and the CSIRTs network to facilitate strategic and operational cooperation, respectively. ENISA's role is emphasized in providing support and guidelines, maintaining a vulnerability registry, and promoting information sharing. The chapter aims to enhance collective cybersecurity resilience through coordinated actions and shared knowledge among Member States and EU institutions.

1.4.1. Article 13: Cooperation Group

Establishes a Cooperation Group to facilitate strategic cooperation and information exchange among Member States and to support the implementation of the Directive.

1.4.2. Article 14: CSIRTs Network

Creates a network of Computer Security Incident Response Teams (CSIRTs) to enhance operational cooperation, information sharing, and coordinated responses to cross-border cybersecurity incidents.

1.4.3. Article 15: ENISA Support

Allocates significant responsibilities to the European Union Agency for Cybersecurity (ENISA), including providing support to Member States, developing guidelines, and maintaining a European vulnerability registry.

1.4.4. Article 16: Cooperation at Union Level

Encourages collaboration between Member States and Union institutions, agencies, and bodies to foster a harmonized approach to cybersecurity across the EU.

1.5. Chapter V: Supervision and Enforcement

Chapter V sets out the mechanisms for ensuring compliance with the Directive. It requires Member States to establish supervisory authorities with the power to monitor, audit, and enforce the Directive's requirements. The chapter details the enforcement measures, including penalties and sanctions, that can be applied to entities that fail to comply. This regulatory framework is designed to ensure that cybersecurity measures are effectively implemented and maintained across the EU.

1.5.1. Article 17: Supervisory Authorities

Mandates the establishment of supervisory authorities within Member States responsible for monitoring and enforcing compliance with the Directive.

1.5.2. Article 18: Powers of the Supervisory Authorities

Details the powers granted to supervisory authorities, including the ability to conduct audits, inspections, and impose penalties for non-compliance.

1.5.3. Article 19: Enforcement Measures

Describes the enforcement measures available to supervisory authorities to ensure adherence to the Directive's requirements, such as fines, sanctions, and corrective actions.

1.5.4. Article 20: Penalties and Administrative Sanctions

Outlines the penalties and administrative sanctions that can be imposed on entities for breaches of the Directive, ensuring a deterrent effect and promoting compliance.

1.6. Chapter VI: Final Provisions

The final chapter includes transitional measures for the smooth implementation of the Directive, guidelines for reviewing and reporting on its effectiveness, and the formal repeal of the previous NIS Directive. It also specifies the timeline for the Directive's entry into force and application, providing Member States with a clear schedule for compliance. This chapter ensures that the transition to the new legal framework is orderly and that the Directive remains adaptable and responsive to future cybersecurity challenges.

1.6.1. Article 21: Transitional Measures

Provides guidance on the transitional measures Member States should adopt to ensure a smooth implementation of the Directive.

1.6.2. Article 22: Review and Reporting

Requires regular review and reporting on the implementation and effectiveness of the Directive, ensuring it remains relevant and effective in addressing cybersecurity challenges.

1.6.3. Article 23: Repeal of Directive (EU) 2016/1148 (NIS Directive)

Formally repeals the previous NIS Directive, establishing NIS2 as the new legal framework for cybersecurity in the EU.

1.6.4. Article 24: Entry into Force and Application

Specifies the date of entry into force of the Directive and its application timeline, providing Member States with a clear implementation schedule.

The NIS2 Directive aims to significantly enhance cybersecurity across the European Union by updating and expanding the original NIS Directive. The directive introduces new measures and extends its scope to address evolving cyber threats. Below is a detailed list of the chapters and articles of the directive, including in-depth descriptions of each chapter's focus and the specific articles within them.

Chapter I: General Provisions

This chapter sets the stage for the directive, outlining its purpose, scope, and key definitions. It provides the foundational framework for all subsequent chapters.

Article 1: Subject matter

Defines the primary objective of the directive: to achieve a high common level of cybersecurity across the EU by improving the security of network and information systems【14†source】【16†source】.

Article 2: Scope

Expands the directive’s applicability to include more sectors, such as telecommunications, social media platforms, and food production, reflecting the growing importance of these areas in national and economic security【15†source】.

Article 3: Essential and important entities

Categorizes entities into "essential" and "important," with essential entities including critical infrastructure sectors like energy and healthcare, and important entities covering areas like food production and digital services. This classification determines the level of regulatory obligations【14†source】【16†source】.

Article 4: Sector-specific Union legal acts

Addresses how the NIS2 Directive interacts with other sector-specific EU regulations to ensure coherence and avoid regulatory overlap【16†source】.

Article 5: Minimum harmonisation

Sets baseline cybersecurity requirements that member states must meet or exceed, ensuring a consistent approach across the EU【15†source】.

Article 6: Definitions

Provides clear definitions for key terms used throughout the directive, ensuring uniform understanding and implementation【14†source】.

Chapter II: National Frameworks on Cybersecurity

This chapter mandates the creation and implementation of robust national cybersecurity frameworks by member states.

Article 7: National cybersecurity strategy

Requires each member state to develop and adopt a comprehensive national cybersecurity strategy that aligns with the directive's goals【16†source】.

Article 8: Competent authorities and single points of contact

Mandates the designation of national authorities responsible for overseeing the implementation of the directive, as well as single points of contact for coordination【14†source】.

Article 9: National cyber crisis management frameworks

Establishes frameworks for managing cyber crises at the national level, ensuring preparedness and coordinated responses【15†source】.

Article 10: Computer security incident response teams (CSIRTs)

Specifies the formation and roles of CSIRTs, which are essential for responding to cybersecurity incidents effectively【16†source】.

Article 11: Requirements, technical capabilities and tasks of CSIRTs

Details the technical capabilities and specific tasks that CSIRTs must possess and perform to ensure robust incident response capabilities【15†source】.

Chapter III: Cybersecurity Risk Management and Reporting Obligations

Focuses on mandatory risk management practices and stringent reporting requirements for cybersecurity incidents.

Article 12: Coordinated vulnerability disclosure and a European vulnerability database

Encourages the coordinated disclosure of vulnerabilities and establishes a central database to manage and share information on vulnerabilities【16†source】.

Article 13: Cooperation at national level

Promotes cooperation among national authorities within member states to enhance cybersecurity measures【14†source】.

Article 14: Cooperation Group

Forms a cooperation group to facilitate strategic collaboration and information exchange between member states【15†source】.

Article 15: CSIRTs network

Creates a network of CSIRTs to improve cooperation and coordination across the EU【16†source】.

Article 16: European cyber crisis liaison organisation network (EU-CyCLONe)

Establishes EU-CyCLONe to manage large-scale EU-wide cybersecurity incidents, enhancing coordination during crises【14†source】【15†source】.

Article 17: International cooperation

Promotes international partnerships and cooperation on cybersecurity issues to address global cyber threats【15†source】.

Article 18: Report on the state of cybersecurity in the Union

Requires an annual report on the state of cybersecurity in the EU, providing transparency and accountability【16†source】.

Article 19: Peer reviews

Introduces peer reviews to enhance collaboration and share best practices among member states【14†source】.

Article 20: Governance

Defines governance structures for the implementation of the directive, ensuring effective oversight and management【16†source】.

Article 21: Cybersecurity risk-management measures

Mandates specific cybersecurity risk management measures for covered entities, including risk assessments and security policies【15†source】.

Article 22: Union level coordinated security risk assessments of critical supply chains

Calls for coordinated security risk assessments of critical supply chains at the EU level to enhance resilience【14†source】.

Article 23: Reporting obligations

Sets out stringent reporting obligations for cybersecurity incidents, requiring initial notifications within 24 hours and detailed reports within 72 hours【15†source】.

Article 24: Use of European cybersecurity certification schemes

Promotes the use of European cybersecurity certification schemes to ensure the security and reliability of products and services【16†source】.

Article 25: Standardisation

Encourages the development and adoption of standardized cybersecurity practices across the EU【15†source】.

Article 26: Jurisdiction and territoriality

Clarifies the jurisdictional and territorial scope of the directive, ensuring clear applicability【16†source】.

Article 27: Registry of entities

Requires the registration of entities covered by the directive, providing oversight and facilitating coordination【15†source】.

Article 28: Database of domain name registration data

Establishes a database for domain name registration data to improve transparency and accountability in digital operations【16†source】.

Article 29: Cybersecurity information-sharing arrangements

Facilitates information-sharing arrangements to enhance cybersecurity across the EU【14†source】.

Article 30: Voluntary notification of relevant information

Allows for the voluntary notification of relevant cybersecurity information, encouraging proactive disclosure and collaboration【15†source】.

Chapter IV: Supervision and Enforcement

Details the supervisory and enforcement mechanisms to ensure compliance with the directive, including penalties for non-compliance.

Article 31: General aspects concerning supervision and enforcement

Outlines general principles for supervising and enforcing the directive, ensuring consistent application across member states【14†source】.

Article 32: Supervisory and enforcement measures in relation to essential entities

Specifies the supervisory and enforcement measures applicable to essential entities, ensuring they meet the highest standards of cybersecurity【15†source】.

Article 33: Supervisory and enforcement measures in relation to important entities

Specifies the measures for important entities, providing a tiered approach to supervision and enforcement【16†source】.

Article 34: General conditions for imposing administrative fines on essential and important entities

Sets conditions for imposing fines for non-compliance, including criteria for determining the severity of penalties【14†source】.

Article 35: Infringements entailing a personal data breach

Addresses breaches involving personal data, ensuring that appropriate measures are taken to protect individuals' privacy【15†source】.

Article 36: Penalties

Details the penalties for non-compliance, which can include fines up to €10 million or 2% of global annual turnover for essential entities【16†source】.

Article 37: Mutual assistance

Promotes mutual assistance among member states to ensure effective enforcement of the directive【14†source】.

Chapter V: Final Provisions

Covers procedural and administrative aspects of the directive’s implementation and future amendments.

Article 38: Exercise of the delegation

Details the delegation of powers for the implementation of the directive, ensuring that appropriate authorities can enforce the measures【15†source】.

Article 39: Committee procedure

Explains the procedure for adopting implementing acts, ensuring that changes can be made efficiently and transparently【16†source】.

Article 40: Review

Mandates periodic review of the directive’s implementation and effectiveness to ensure it remains relevant and effective【14†source】.

Article 41: Transposition

Sets deadlines for member states to transpose the directive into national law, ensuring timely implementation【15†source】.

Article 42: Amendment of Regulation (EU) No 910/2014

Amends existing regulations to align with the NIS2 Directive, ensuring consistency across related legislative frameworks【16†source】.

Article 43: Amendment of Directive (EU) 2018/1972

Amends other directives to ensure coherence with NIS2, avoiding regulatory conflicts【14†source】.

Article 44: Repeal

Repeals the original NIS Directive, replacing it with the updated NIS2 measures【15†source】.

Article 45: Entry into force

Specifies the date when the directive comes into effect, allowing member states and entities to prepare for compliance【16†source】.

Article 46: Addressees

Identifies the entities addressed by the directive, ensuring clarity on who is subject to its provisions【14†source】.

For more detailed information, you can refer to the full text of the NIS2 Directive on the official NIS2 Directive information site【14†source】【15†source】【16†source】.

sentenz / convention

Create an article about `NIS2` #337