The NIS 2 Directive

Incident reporting

Under NIS 2, essential and important entities must report - without undue delay - any incident that has a significant impact on the provision of their services to their National Computer Security Incident Response Teams (CSIRT) or appropriate national authority. 

In order to comply with these reporting obligations, organisations must submit: 

• Early warning: Issued without undue delay and no later than 24 hours of becoming aware of the incident, stating whether the event is thought to have been the result of unlawful or malicious activity or could have cross-border ramifications;

• Incident notification: Issued without undue delay and no later than 72 hours of becoming aware of the incident, thereby updating the information provided in the early warning and giving a preliminary evaluation of the incident's severity and effects;

• Intermediate report: Issued upon request of the CSIRT or the appropriate national authority, highlighting relevant status updates in incident and crisis management.

• Final report: Must be submitted no later than one month after the incident notification was submitted. A thorough description of the incident - including its root cause, any adopted mitigation strategies, and any cross-border effects - must be included in the final report.

Supervisory framework

When compared to its predecessor, NIS 2 provides a tough enforcement framework in order to ensure a higher level of compliance. 

First and foremost, competent national authorities will be able to rely on a robust enforcement and investigation framework, the limits of which depend on the classification of your organisation.

• Essential entities: Subject to a comprehensive, ex ante, supervisory regime, in which the supervisory powers of the national authorities include the ability to conduct random raids, perform (ad hoc) security audits as well as the ability to request certain information and evidence of compliance.

• Important entities: Subject to lighter, ex post, supervisory regime that is applicable in the event of evidence and/or indications of non-compliance.

Management responsibility and liability

Under NIS 2, the management bodies of essential and important entities must approve cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements by their organisation.

In this context, all members of management bodies will also be required to follow training on a regular basis in order to gain sufficient knowledge and skills to identify risks and assess cybersecurity risk management practices and their impact on the services provided by their organisation.

Enforcement

Under NIS2, member states must provide the appropriate national authority with the discretionary power to impose considerable fines on organisations that do not comply with the national transposition laws.

• Essential entities: At least up to €10 million or 2% of their worldwide annual turnover

• Important entities: At least up to €7 million or 1.4% of their worldwide annual turnover