NIS2

NIS2 is the EU’s updated directive on network and information security, which significantly expands cybersecurity requirements compared to the previous NIS Directive. It covers significantly more sectors and organizations, imposes stricter requirements for risk management and incident reporting—and introduces personal liability for management and the board of directors.

What does NIS2 require of your organization?

NIS2 sets specific requirements for the organizations it covers:

  • Risk Management Measures: Technical and organizational measures to manage risks to networks and information systems.
  • Incident Reporting: Serious incidents must be reported to the appropriate authority within strict time frames.
  • Management's Responsibilities: The board of directors and management must approve and monitor security measures—and may be held personally liable.
  • Supply Chain: The requirements also cover security in your supplier and subcontractor chains.

Common Challenges with NIS2 Compliance

  • It is unclear whether you are covered: Many companies are unsure whether and how the expanded regulations will affect them.
  • Skills Shortage: There is an acute shortage of qualified security professionals in the market.
  • Technical and organizational gaps: Existing information security rarely meets the new requirements without extensive measures.
  • Coordination with Other Regulations: These requirements must be addressed in conjunction with, for example, GDPR compliance.

Here's How an Interim CIO or Chief Security Officer Can Ensure Compliance

NIS2 often provides a reason to temporarily bring in an interim security manager or CIO—roles that are available within our consulting network.

  • Quick gap analysis: One interim CIO assesses where the organization stands in relation to the requirements and what needs to be addressed.
  • Establishes governance: An interim security manager establishes the risk management and incident reporting processes required by the directive.
  • Technical height: One Interim CTO can lead technical initiatives in the supply chain and infrastructure.
  • Immediate capacity: Interim Search’s process ensures that you have the right talent in place within 48 hours—which is critical when deadlines are tight.

Frequently Asked Questions About nis2

Which organizations are covered by NIS2?

NIS2 covers a wide range of sectors considered to be critical or important to society, such as energy, transportation, healthcare, digital infrastructure, food, and manufacturing. Generally, medium-sized and large organizations in these sectors are covered, but the boundaries may vary. A first step should be to determine whether and how you are covered.

What is the difference between NIS and NIS2?

NIS2 expands the scope of application to include more sectors, tightens requirements for risk management and incident reporting, harmonizes penalties among member states, and introduces explicit accountability for management and the board of directors. In practice, this means significantly higher requirements for a significantly larger number of organizations.

Can management be held personally liable under NIS2?

Yes, a key new feature of NIS2 is that management bodies must approve and oversee cybersecurity measures, and that they can be held accountable for noncompliance. This makes cybersecurity a clear management and board issue, not just an IT issue.

Do you need help? Contact us for a free discussion on how we can support you.