The new NIS-2 directive

The NIS-2 Directive is EU-wide legislation on network and information security. The aim is to strengthen the cyber security of companies and ensure a uniformly high level of security in the EU. Each company is responsible for assessing whether it is affected by the Network and Information Security Directive (NIS-2 for short). The type of business activity in the EU is the decisive factor. A total of 18 sectors are affected by the NIS-2 Directive. It actually has its origins in the NIS Directive (Network and Information Security Directive), which was introduced in 2016. The NIS-2 Directive came into force on January 16, 2023 and must be implemented by the EU by October 17, 2024 and must be transposed into national law by the EU member states. What has changed compared to the NIS Directive? With the introduction of NIS-2 Directive

• the scope of application has been extended to numerous additional sectors,
• stricter safety requirements have been introduced,
• established stricter liability regulations for the management and
• higher penalties introduced for non-compliance.

Our world is changing and becoming increasingly digital – devices and systems are becoming more intelligent and increasingly networked. This advancing digitalization not only brings immense benefits and opportunities, but also growing risks and challenges in the area of cyber security. In view of these risks, security measures are becoming increasingly important. The NIS-2 Directive will ultimately encourage companies to take action against cyber threats in order to improve the level of security in EU member states and ensure the protection of critical infrastructure and sensitive data.

The directive affects companies and organizations associated with the KRITIS sector, i.e. those that play a significant role in society and the economy, but also companies that are involved in the supply chain of critical actors, for example. The future relevance of the NIS-2 Directive for many small and medium-sized enterprises (SMEs) results from the requirement that companies and organizations with at least 50 employees or an annual turnover of at least 10 million euros must also comply with the Directive. If your company is affected by the NIS-2 Directive, you are obliged to implement and regularly update comprehensive IT security measures, including risk analysis and emergency plans. There is also a reporting obligation that requires security incidents to be reported promptly.

A laissez-faire attitude in the defense against hacker attacks will be noticeably punished in the future. Instead of the 150,000 euros that the first version of the NIS stipulated as the maximum amount for sanctions, operators of essential services will in future face heavy fines. Fines for breaches of Art. 21 (risk management measures) and Art. 23 NIS-2 Directive (reporting obligations for significant security incidents).

We support you with our IT security solution [R.E.D.] to set up and manage your IT infrastructure in compliance with the law. In [R.E.D.] advanced technologies and systems are brought together and applied in such a way that you can guarantee full protection for your company network. A decisive advantage for you is that with the [R.E.D.] service, you hand over responsibility for continuous 24/7 monitoring to us. This allows you to concentrate fully on your core business while we take care of all security-related aspects for you. In the event of a security incident, we will inform you immediately and offer you comprehensive support in decision-making from our experts. To ensure that you do not lose track of your IT infrastructure, we prepare regular reports on the security situation of your company. It is important to realize that investing in an IT security solution not only serves to comply with legal regulations, but also represents a considerable advantage for your company. Because in the event of an attack, your valuable company data is at stake and timely preventive measures can save you considerable damage and costs. Contact us and we will find a customized [R.E.D.] solution for you.