Return to overview
6 min read

NIS2: how will it be transposed in European countries?

6 min Read
June 2, 2023
By: Eye Security
image
By: Eye Security
7 March 2024

The NIS2 Directive is the latest European cybersecurity regulation, aiming to improve the overall cybersecurity measures and resilience against cyberattacks across various sectors. It requires companies to promptly report security incidents to authorities and comply with new regulations. Non-compliance can result in significant financial penalties and, in some cases, director responsibility.

SMEs need to be aware of the NIS2 Directive and how it impacts their business, focusing on:

  1. Enhancing their cybersecurity posture to protect against evolving cyber threats.
  2. Staying informed about the changing regulatory landscape and adapting accordingly.
  3. Ensuring timely incident detection, response, and reporting as required by NIS2.

Introduction

After being voted through by MEPs in November 2022, the new "NIS-2" directive came into force on 16th January 2023. European Union Member States now have 21 months (until 17th October 2024) to transpose these measures into national law. What are the key elements of the NIS directive reform? How are countries such as France, Germany, Belgium or the Netherlands planning to transpose these new cybersecurity measures and requirements into their respective national legislations? This article explains how.

1. NIS2, a legislative shield to reinforce cybersecurity in Europe

In 2016, the European Union adopted the Directive for Security of Networks and Information Systems (NIS), a first series of cybersecurity-dedicated measures. It sought to raise the level of security on the European market in response to threats related to digital transformation in the Member States.

As these threats evolved, cyberattacks on the supply chain increased and cyber crime became more professional, the directive needed to be reinforced. This is why NIS-2 is expanding both its objectives and its scope. This new version of the directive will harmonise and reinforce the European market's cybersecurity and in particular will:

  • Enforce organisations to improve their resilience to cyberattacks.
  • Harmonise cybersecurity obligations across all sensitive sectors which are vital for society and nations to function properly.
  • Oblige companies to report security incidents and their response to the competent authorities within 24 hours.
  • Improve information sharing between Member States.

For most countries, 35 sectors of activity (compared to 19 in the first version) are now covered by the European directive, including the energy, water and transport sectors, as well as the waste management, postal services and food production sectors. It's important to note that not all SMEs are subject to NIS2. This regulation specifically applies to companies with more than 50 employees and 10 million euros yearly turnover, with certain exceptions for companies operating in specific areas such as MSPs and MSSPs. These regulations are applicable across all EU member states.

In addition, the previous statuses such as OES (Operator of Essential Services) for France, an operator whose activity is considered as key for society and the country and where a failure could have a significant impact on the operation and security of the State, have given way to the new acronyms EE (Essential Entities) and IE (Important Entities). Digital service providers and regional authorities are also now integrated into this security mechanism along with the whole supply chain, who were the main parties left out of the NIS-1 directive.

It now falls to each country to draw up a list of national entities who will need to submit to the NIS-2 directive. All the private or public companies concerned will then need to meet the Directive's requirements and will also be obliged to notify their competent authorities of any security incidents within 24 hours for early alerts and within 72 hours for incident declarations.

In the event of non-compliance, NIS-2 provides for significant financial penalties (in millions of Euro or as a % of worldwide turnover) and also engages the responsibility of directors in specific cases. These sanctions will be announced by the competent national authorities.

2. In the Netherlands: an increase in the number of competent authorities

The law on network and information system security, Wet beveiliging netwerk- en informatiesystemen  (Wbni) is the Dutch implementation of the NIS-1 directive and is due to be updated with the revision of the NIS-2 directive. The Dutch regulator Rijksinspectie Digitale Infrastructuur (RDI) has developed a self-evaluation tool . Organisations can use it to determine themselves if the provisions of the Wbni apply to them. This system will be evolving with the transposition of NIS-2. For its part, the Dutch competent authority, the Nationaal Cyber Security Centrum  (NCSC), has announced on its website that an Internet consultation period will take place in 2023 with citizens, companies and government institutions in order to "indicate any improvements to the legislation and the regulations which are being drafted".

Note that in the Netherlands there is no one single competent authority  and that incidents are reported  to the NCSC's CERT  and to the regulator concerned according to the sectors of activity:

  • National digital infrastructure inspection: RDI since 1st January 2023, replacing the Autoriteit Persoonsgegevens (AP) regulator, which is the regulating body for cybersecurity and data protection in the Netherlands.
  • Dutch central bank (DNB): for companies in the financial sector.
  • Human environment and transport inspection (ILT): for companies in the telecommunications sector.
  • Health and youth assistance inspection (IGJ): for bodies in the health and youth sector.

3. In Germany: the IT security law 3.0

In 2015 , the law on improving IT security and cybersecurity (Gesetz zur Erhöhung der Sicherheit informationstechnischer Systeme) obliged critical companies designated as KRITIS  (Kritische Infrastrukturen), to prove their compliance with the security requirements laid down by the BSI (Bundesamt für Sicherheit in der Informationstechnik), Germany's federal agency for information technology security.

In June 2017, the NIS1 directive was transposed into an IT security law called IT-Sicherheitsgesetz. In this context, the BSI received new powers and functions and is the competent authority responsible for monitoring the security of KRITIS operators and digital service providers. The BSI is also tasked with coordinating the response to cybersecurity incidents at a national level.

In 2021, the law on IT security 2.0  reinforced the security level of KRITIS entities which now need to detect attacks, indicate the relevant incidents and provide information to the BSI for crisis management.

NIS-2's requirements could be dealt with as the version 3.0  of the law on IT security, which plans to expand the methodology, the regulated companies and the obligations. In effect, NIS-2 imposes itself on the KRITIS but does not stop there. The BSI is tasked with identifying the EE and IE entities in its country (an expansion of the current KRITIS operators) and monitoring and applying the cybersecurity requirements imposed by the NIS-2 directive.

4. In Belgium: the NIS-2 law

Created in 2015, the competent national authority agency is the CCB (Centre for Cybersecurity Belgium) which is attached to the Federal Public Service (SPF) of the Prime Minister's Chancery. It enabled the 2016 NIS European directive to be transposed into the NIS-1 law of 2019. All security incidents affecting the entities concerned must be indicated on the incident declaration platform set up by the CCB  and the CERT.be (https://nis-incident.be/).

For this second version of the directive, the Belgian centre estimates that the number of organisations affected has increased by a factor of 20 , from around one hundred at the moment to some 2 500 entities. 18 sectors are affected in Belgium. The 6 sectors in NIS-1 are expanded with 12 new sectors, such as the food production industries, public services, the chemicals industries or the health and energy sectors.

The new NIS-2 law is currently being prepared in order to be published before October 2024, the deadline imposed by the NIS-2 directive. This law will apply to entities established in Belgium defined on the CCB's official website  as implying "the effective exercise of an activity via a stable installation. The legal form retained for such an establishment, whether it is a branch office or a separate legal subsidiary, is not vital in this respect. This criterion should not depend on the physical location of the network and the information systems". Foreign companies who have a presence in Belgium and whose sectors of activity are included in the 18 key sectors will be subject to the NIS-2 directive.

5. In France: from OIVs to EEs

In 2013, the LPM (Military Programming Law) introduced the concept of OIVs (Organisation of Vital Interest) and imposed high security requirements on them. In 2018, the OIVs were expanded to OESs with the transposition of NIS into French law. These major actors who were essential to the smooth operation of the State were then obliged to submit to cybersecurity measures and report their security incidents to the ANSSI (Agence nationale de la sécurité des systèmes d’information), France's national digital security authority.

The ANSSI is piloting the work to transpose the NIS-2 directive into French law, in conjunction with government ministers, the different stakeholders in France and European partners. The agency is also tasked with drawing up the country's list of essential and important entities, which are classified according to their level of criticality. The ANSSI "plans to use this concept to define requirements which are adapted and proportionate to the stakes involved in each of these categories", it states on its official website .

Guillaume Poupard, the ANSSI's Chief Executive, said when NIS-2 was adopted in the European Parliament in June 2022  "the number of actors classified as OES will increase by a factor of 10 and they will be regulated". The future legislation affects thousands of entities, from SMEs to CAC40-registered companies, not forgetting administrations of all sizes (central administrations and regional authorities).

Conclusion

Each Member State and its competent authorities are now working to transpose the NIS-2 directive so that national legislation can be adopted by October 2024. If your company provides digital services in the sectors mentioned in the European Union, it is vital that you make sure that you meet the compliance requirements in each of these countries. As we have seen, the list of sectors may vary according to the countries and the competent authorities involved. This is also the case for how security incidents are reported.

If you would like help from cybersecurity professionals, don't hesitate to contact eye security's teams.

Eye Security's Offering

To help organisations navigate the complex NIS2 requirements, Eye Security offers a comprehensive Managed Detection and Response (MDR) service combined with insurance coverage. This all-in-one package is designed to provide an easy-to-understand and cost-effective solution, with prices starting from €10 per employee per month.

By partnering with Eye Security, SMEs can:

  1. Improve their overall cybersecurity posture and resilience against cyberattacks.
  2. Stay up-to-date and prepared for evolving cybersecurity regulations.
  3. Receive expert assistance in incident detection, response, and reporting to comply with NIS2's reporting requirements.
  4. Minimise the financial and operational impact of cybersecurity incidents with tailored insurance coverage.

With Eye Security, organisations can confidently focus on their core business while ensuring their cybersecurity needs are professionally managed and aligned with the NIS2 Directive requirements.

Let's talk

Curious to know how we can help?

Get in touch
Share this article.

Related articles.