NIS2 Directive: What It Means for Affected Companies

In key sectors of the economy, such as energy, IT, transport and water supply, the NIS2 Directive aims to establish uniform security standards across the EU and ensure the resilience of IT systems, both physically and digitally. But what does this mean in practice for the companies affected? What requirements must they meet, and what are the consequences of non-compliance?

The NIS2 Directive was supposed to be transposed into national law by 18 October 2024, but this has not yet happened in Germany. Nevertheless, companies should address the implications of the directive as soon as possible to avoid fines and other sanctions once it comes into force. We therefore provide an overview of what the directive stipulates, which companies are affected and what penalties may apply in the event of non-compliance.

What Is the NIS2 Directive?

The NIS2 Directive (Directive (EU) 2022/2555) is the revised version of the NIS Directive (2016) and was adopted by the European Parliament and the Council of the European Union. It covers network and information systems (NIS) and addresses how cybersecurity can be maintained across a total of 18 critical sectors throughout the EU. It also requires Member States to establish national cybersecurity strategies to transpose the directive into national law.

The development of the new directive was prompted by a proposal from the European Commission in 2020 to revise NIS1. A review had revealed that companies operating in the EU lacked sufficient cyber resilience and that there was an inadequate shared understanding of the key threats and challenges across the EU. The directive entered into force on 16 January 2023, and Member States were required to transpose it into national law by 17 October 2024.

What Does the Directive Cover?

In summary, the directive aims to:

• Improve the cyber resilience of critical entities
• Promote information sharing and cooperation between Member States
• Establish uniform security standards for network and information systems throughout the EU

The directive requires EU Member States to adopt national cybersecurity strategies and designate national Computer Security Incident Response Teams (CSIRTs) to manage risks and incidents. It also harmonises the sanctions that Member States can impose.

Which Companies Are Affected by NIS2?

While NIS1 focused on "essential entities" (e.g. energy and transport), NIS2 also applies to "important entities", such as postal services and waste management companies.

Essential entities are subject to stricter supervision and more stringent reporting requirements. These include companies operating in the following sectors:

• Energy
• Transport
• Banking
• Financial market infrastructure
• Healthcare
• Drinking water supply
• Digital infrastructure
• Public administration
• Space infrastructure

Important entities are subject to less stringent supervision but must also comply with reporting obligations. These include companies operating in the following sectors:

• Postal services
• Waste management
• Chemical industry
• Food production
• Manufacturing of critical goods (such as medical technology or mechanical engineering)
• IT service providers (such as data centres and content delivery networks)

As a general rule, the NIS2 Directive applies to companies with 50 or more employees and an annual turnover exceeding €10 million. However, smaller companies may also be affected if they are considered systemically important. This includes companies that play a significant role in public or economic life, operate within supply chains for critical services, face particular risks such as cyberattacks, or are affected by dependencies on third countries.

What Are the Specific Security Measures Required Under NIS2?

Companies affected by the directive must implement technical and organisational security measures, particularly in areas such as risk management, access controls and encryption. They must also conduct regular security audits and risk assessments. Security incidents must be reported within 24 hours.

In addition, affected organisations must register with the relevant authorities. This means that within three months of the national NIS2 legislation coming into force in their respective country, companies in Germany, for example, must register with the Federal Office for Information Security (BSI).

The specific security measures that companies must implement are outlined in the official NIS2 Directive and, specifically for the IT services sector, in the Implementing Act for IT Service Providers. These two documents provide insight into the specific requirements. However, the exact implications for other industries and at national level will only become clear through national regulations (which, for example, have not yet been introduced in Germany and Austria).

Which Security Measures Must Organisations Implement?

Establishing Security Policies

It is essential to establish policies for risk analysis and the security of information systems. Organisations must document their approach to securing their IT systems and networks, including clearly defined roles and responsibilities.

Establishing Incident Management Procedures

Procedures must be documented in detail to ensure that IT incidents are contained, problems or vulnerabilities are resolved, and normal operations can be restored. Key questions include: Who is responsible for detecting and responding to incidents? What measures need to be taken? What reporting obligations must be fulfilled towards the relevant authorities? In the event of a significant security incident, for example, the competent authority must be notified within 24 hours of becoming aware of the incident.

Business Continuity and Emergency Planning

This involves establishing backup management, procedures for restoring systems and data following incidents, and a clear crisis management framework. These measures help ensure business continuity and the restoration of normal operations. The plan must define roles, responsibilities and procedures. Particular emphasis should be placed on creating and maintaining backups and ensuring sufficient resource redundancy to minimise system failures.

Monitoring

Operators are required to monitor activities within their IT systems. Monitoring should be automated using appropriate tools. Examples of events that should be monitored and documented include network traffic, application access, authentication events, privileged account activities, access to backups and physical access to facilities.

Supply Chain Security

This concerns data security throughout the supply chain, including security-related aspects of relationships between organisations and their direct suppliers or service providers. Organisations must establish a supply chain security policy.

Clear criteria must be defined for selecting suppliers, taking their security practices into account. Service Level Agreements (SLAs) must also address personnel and IT security requirements.

Security in the Acquisition, Development and Maintenance of Network and Information Systems

Organisations must ensure that security requirements are met when selecting IT products and services and that the security features of these products are configured correctly. Protection against malware, regular vulnerability scans and security testing help maintain the ongoing security of IT products. This also means replacing products that no longer receive security updates.

Cybersecurity Assessment

Organisations must develop policies and procedures to assess the effectiveness of their cybersecurity risk management measures. This involves not only reviewing existing security measures but also conducting regular assessments and implementing continuous improvements.

Access Control

Clear guidelines are required to define who has access to which resources and systems. This applies to employees, visitors, external service providers, interfaces and applications.

The entire lifecycle of user accounts must be considered. This includes regularly reviewing and adjusting access permissions according to the principle of least privilege, as well as disabling or deleting access rights when individuals leave the organisation.

Multi-Factor Authentication

Organisations must establish policies and procedures for the use of multi-factor authentication or continuous authentication solutions, secure voice, video and text communications, and, where appropriate, secure emergency communication systems within the organisation.

Penalties for Non-Compliance with NIS2

To ensure that companies comply with the directive, significant penalties and liability risks are предусмотрены for non-compliance. In addition to financial penalties, organisational and personal consequences for company management are possible. Managing directors may be held personally liable if they are found to have neglected their supervisory duties. This can result in dismissal, professional disqualification, or civil and criminal liability.

The following fines may be imposed for violations:

• Essential entities: €10 million or, for companies with an annual turnover exceeding €500 million, 2% of their worldwide annual turnover.
• Important entities: €7 million or, for companies with an annual turnover exceeding €500 million, 1.4% of their worldwide annual turnover.
• Fines of €2 million: Manufacturers of IT systems may face fines of up to €2 million if they refuse to cooperate with BSI instructions to restore the security or functionality of IT systems. Telecommunications and telemedia providers may also face fines of this amount if they fail to implement measures ordered by the BSI to prevent specific significant threats.
• Fines of €1 million: For example, operators of critical infrastructure may face fines if they fail to provide accurate or complete evidence of compliance with the relevant requirements.

A more detailed overview of potential fines is provided by OpenKRITIS, a platform dedicated to the protection of critical infrastructure.

Differences Between NIS2 and ISO 27001

At first glance, NIS2 and ISO 27001 appear similar, as both are frameworks designed to strengthen cybersecurity and risk management within organisations. However, they differ in their focus, legal status and scope of application. Here are some of the key differences:

• Legal obligations: The NIS2 Directive is a binding EU directive that must be transposed into national law. ISO 27001, on the other hand, is an international standard for which certification is voluntary.
• Certification: NIS2 does not provide for formal certification. Compliance is monitored by the competent authorities. ISO 27001, however, allows organisations to obtain certification through accredited auditors.
• Supervision and audits: NIS2 involves regulatory supervision and potential fines for non-compliance. ISO 27001 requires regular external audits to maintain certification.
• Reporting obligations and liability: Under NIS2, incidents must be reported to the relevant authorities. ISO 27001 does not establish a comparable legal reporting obligation to a designated authority. Unlike NIS2, ISO 27001 does not itself impose statutory liability on management for implementation.

ISO 27001 can therefore serve as a foundation for meeting NIS2 requirements in areas such as risk management, technical security measures and security policies. However, ISO 27001 certification alone does not guarantee full compliance with the NIS2 Directive.

Current Implementation of NIS2 in Germany

In Germany, the Federal Office for Information Security (BSI) is responsible for overseeing cybersecurity, and legislation to implement NIS2 is in preparation. A government draft was presented on 24 July 2024, but Germany failed to meet the implementation deadline of 18 October 2024.

Following the 2025 Bundestag elections, legislative proposals that had not yet been adopted must be reintroduced and renegotiated. As a result, implementation of NIS2 is not expected before the second quarter of 2025.