All regulations / EU Cybersecurity
NIS2
Know the rule before it knows you.
Cybersecurity duties, board accountability and incident reporting for essential and important entities.
What it is
NIS2 widens EU cybersecurity law to many more sectors, including digital infrastructure, managed service providers, cloud and data-centre providers, online marketplaces, search engines and social networks, as well as energy, transport, health, water, manufacturing of certain products and food. Management bodies are personally accountable for approving and overseeing cybersecurity measures.
This applies to you if
- You are a medium or large company in a listed sector, or a digital service provider of any size in certain categories
- You supply software or services to an in-scope entity, which must manage you as a supply-chain risk
- You are a managed service or managed security provider, cloud or hosting provider
What it asks of you
- Registration with the national authority
- Risk-management measures: policies, incident handling, business continuity, supply-chain security, secure development, access control, encryption, MFA
- Incident reporting: early warning within 24 hours, notification within 72 hours, final report within a month
- Training and oversight by the board; personal liability for management
What it costs to ignore
Up to EUR 10 million or 2% of worldwide turnover for essential entities, EUR 7 million or 1.4% for important entities, plus management liability and possible suspension of managers.
Key dates
EU transposition deadline 17 October 2024. The Dutch Cyberbeveiligingswet follows with delay; registration and incident duties apply as it enters into force. We track the current status.
How we help
Not sure which apply to you? Send us three lines about what you sell and to whom, and we will tell you which rules matter and which do not.
Have a regulatory question?
Send a short description of your situation. We reply within one working day, usually with a view on scope and a fixed fee where possible.