On October 18, 2024, the European directive NIS2 takes effect.

This new legislation on network and information security aims to increase the cybersecurity level of companies that deliver vital, essential and important services in Europe.

Compared to the NIS1 standard (which was then just called NIS, the Network and Information Security regulation), a lot of sectors were added in NIS2 like food industry, waste management, electronic communications network and service providers, postal and courier services, and public administration, to name just a few.

In the first place, these companies have a "duty of care". They have to make a detailed risk assessment and set up procedures for reporting security incidents to better monitor what is happening on their networks, and better understand the impact of malicious activity.

Furthermore, there is the "duty to report" this quickly to the right authorities. NIS2 includes very tight deadlines for reporting incidents and preparing a final report. In addition, executives are now more liable for substandard cybersecurity, and substantial fines may follow if companies do not comply with NIS2.

Read more about NIS2 in our previous article, or visit the resources below.