Nis2 Directive Specialist

NIS2 Directive Specialist

Tools and guidance for EU Directive 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive).

---

Table of Contents

• NIS2 Overview
• Scope and Applicability
• 10 Minimum Security Measures
• Incident Reporting Requirements
• Management Accountability
• Supply Chain Security
• Penalties
• NIS2 vs NIS1 Comparison
• Infrastructure Security Checks
• Tools
• Reference Guides
• Compliance Assessment Workflow
• NIS2 Implementation Roadmap

---

NIS2 Overview

The NIS2 Directive (EU 2022/2555) is the EU's updated framework for cybersecurity, replacing the original NIS Directive (EU 2016/1148). It entered into force on January 16, 2023, with Member States required to transpose it into national law by October 17, 2024.

Key objectives:

• Establish a high common level of cybersecurity across the EU
• Harmonize cybersecurity requirements and enforcement
• Expand scope to cover more sectors and entities
• Strengthen incident reporting obligations
• Introduce management accountability for cybersecurity
• Enhance supply chain security requirements

Legal basis: Article 114 TFEU (internal market harmonization)

Relationship to other frameworks:

---

Scope and Applicability

Essential Entities (Annex I — High Criticality Sectors)

Important Entities (Annex II — Other Critical Sectors)

Size Thresholds

Automatic inclusion regardless of size:

• Trust service providers
• TLD name registries
• DNS service providers
• Public electronic communications networks/services
• Public administration entities
• Sole provider of a service in a Member State
• Entity whose disruption could have significant impact on public safety, security, or health
• Entity whose disruption could induce systemic risk (especially cross-border)

Exclusions:

• Micro and small enterprises (generally excluded unless specifically designated)
• National security, public security, defense, law enforcement
• Judiciary, parliaments, central banks

---

10 Minimum Security Measures (Article 21)

All essential and important entities must implement appropriate and proportionate technical, operational, and organizational measures to manage cybersecurity risks. These measures must be based on an all-hazards approach and cover at minimum:

1. Risk Analysis and Information System Security Policies

Establish and maintain comprehensive risk analysis processes and information security policies covering all information systems.

Requirements:

• Formal risk assessment methodology
• Asset inventory and classification
• Security policy framework (approved by management body)
• Regular policy review cycles (at least annually)
• Risk appetite and tolerance definitions
• Documented risk treatment plans

2. Incident Handling

Implement procedures for detecting, managing, and responding to cybersecurity incidents.

Requirements:

• Incident detection capabilities
• Incident classification and triage procedures
• Incident response plans and playbooks
• Incident escalation procedures
• Post-incident review process
• Integration with CSIRT reporting (see Incident Reporting section)

3. Business Continuity and Crisis Management

Ensure service continuity during and after cybersecurity incidents.

Requirements:

• Business impact analysis (BIA)
• Business continuity plans (BCP)
• Disaster recovery plans (DRP)
• Backup management policies
• Crisis management procedures
• Regular testing of continuity plans (at least annually)
• Recovery time objectives (RTO) and recovery point objectives (RPO)

4. Supply Chain Security

Address security risks in relationships with direct suppliers and service providers.

Requirements:

• Supplier risk assessment process
• Security requirements in contracts with suppliers
• Monitoring of supplier security posture
• Supplier incident notification requirements
• Assessment of aggregate supply chain risks
• Product/service quality and cybersecurity practices of suppliers

5. Security in Network and Information Systems Acquisition, Development, and Maintenance

Integrate security throughout the system lifecycle.

Requirements:

• Secure development lifecycle (SDLC) practices
• Vulnerability management procedures
• Security testing (SAST, DAST, penetration testing)
• Patch management processes
• Change management with security review
• Secure configuration management

6. Policies and Procedures for Assessing Effectiveness

Evaluate whether cybersecurity risk management measures are effective.

Requirements:

• Security metrics and KPIs
• Regular security assessments and audits
• Penetration testing program
• Vulnerability scanning
• Compliance monitoring
• Continuous improvement processes

7. Basic Cyber Hygiene Practices and Cybersecurity Training

Ensure all personnel have adequate cybersecurity awareness and skills.

Requirements:

• Cybersecurity awareness training for all staff
• Role-based security training for technical staff
• Management body cybersecurity training (mandatory under Article 20)
• Phishing simulation exercises
• Security awareness campaigns
• Training records and effectiveness measurement

8. Policies and Procedures Regarding Use of Cryptography and Encryption

Protect data confidentiality and integrity through cryptographic controls.

Requirements:

• Cryptography policy
• Encryption standards for data at rest and in transit
• Key management procedures
• Certificate management
• Cryptographic algorithm selection guidance
• Regular review of cryptographic implementations

9. Human Resources Security, Access Control Policies, and Asset Management

Manage people, access, and assets securely.

Requirements:

• Pre-employment screening and security checks
• Security responsibilities in employment contracts
• Departure procedures (access revocation)
• Role-based access control (RBAC)
• Privileged access management (PAM)
• Asset inventory and ownership
• Acceptable use policies

10. Multi-Factor Authentication, Secured Communications, and Emergency Communications

Deploy strong authentication and secure communication channels.

Requirements:

• MFA for all remote access and privileged accounts
• MFA for access to critical systems
• Continuous authentication where appropriate
• Encrypted communications (TLS 1.2+ minimum)
• Secure emergency communication channels
• Out-of-band communication capabilities
• Secure voice and video communications

---

Incident Reporting Requirements

NIS2 introduces a multi-stage incident reporting regime for significant incidents. An incident is considered significant if it causes or is capable of causing:

• Severe operational disruption or financial loss
• Considerable material or non-material damage to other persons

Reporting Timeline

Additional Requirements

• Entities must inform recipients of their services without undue delay if the significant incident is likely to adversely affect the provision of those services
• Member States may require entities to use specific platforms or templates
• CSIRTs must provide feedback and guidance within 24 hours of receiving early warning
• Active cyber threats must be reported to recipients of services along with remediation measures

---

Management Accountability (Article 20)

NIS2 introduces personal accountability for management bodies — a significant departure from NIS1.

Key requirements:

1. Approval and oversight: Management bodies must approve cybersecurity risk management measures and oversee their implementation
2. Liability: Management bodies can be held liable for infringements of Article 21
3. Training: Members of management bodies must undergo cybersecurity training and encourage similar training for employees
4. Sufficient knowledge: Management bodies must have sufficient knowledge and skills to assess cybersecurity risks and management practices

Consequences of non-compliance:

• Member States may impose a temporary prohibition on natural persons holding management responsibilities at CEO or legal representative level in essential entities
• Administrative fines and other enforcement measures
• Personal liability for management body members who fail to comply

---

Supply Chain Security Deep-Dive

Supply chain security is one of the most impactful new requirements under NIS2.

Requirements

Entities must take into account:

1. Vulnerabilities specific to each direct supplier and service provider
2. Overall quality of products and cybersecurity practices of suppliers, including secure development procedures
3. Results of coordinated security risk assessments of critical supply chains (per Article 22)
4. Supplier contractual arrangements including:
   • Security requirements and certifications
   • Right to audit
   • Incident notification obligations
   • Sub-contractor security requirements

Implementation Framework

Tier 1 — Critical suppliers:

• Full security assessment before onboarding
• Annual security audits or certification verification (ISO 27001, SOC 2)
• Real-time incident notification requirements
• Right to audit clauses
• Exit strategy and data portability requirements

Tier 2 — Important suppliers:

• Security questionnaire and self-assessment
• Periodic security review (biannual)
• Contractual security requirements
• Incident notification within 48 hours

Tier 3 — Standard suppliers:

• Basic security questionnaire
• Annual review of security posture
• Standard contractual security clauses

Coordinated Risk Assessments (Article 22)

The NIS Cooperation Group may carry out coordinated risk assessments of critical supply chains, considering:

• Technical and non-technical risk factors
• Dependencies and potential points of failure
• Risks from non-EU influence on supply chains

---

Penalties

Administrative Fines

Other Enforcement Measures

For essential entities (Article 32):

• Binding instructions
• Orders to implement security audit recommendations
• Orders to bring measures into compliance
• Temporary suspension of certifications or authorizations
• Temporary prohibition of management responsibilities for responsible natural persons

For important entities (Article 33):

• Binding instructions
• Orders to implement security audit recommendations
• Orders to bring measures into compliance
• Administrative fines

Supervisory Regime Differences

---

NIS2 vs NIS1 Comparison

---

Infrastructure Security Checks

DNS Security

• DNSSEC implementation is effectively mandatory for DNS service providers and TLD registries under NIS2
• Validate DNSSEC chain of trust for all zones
• Implement DNS monitoring and anomaly detection
• Consider DNS-over-HTTPS (DoH) or DNS-over-TLS (DoT) for internal resolution
• Monitor for DNS tunneling and exfiltration

Network Monitoring and Segmentation

• Deploy network monitoring for anomaly detection (Article 21(2)(b))
• Implement network segmentation between critical and non-critical systems
• Monitor east-west traffic within data centers
• Deploy network-based intrusion detection/prevention systems
• Maintain network flow logs for forensic analysis

Endpoint Detection and Response

• Deploy EDR solutions on all endpoints accessing critical systems
• Configure automated threat detection and response
• Maintain endpoint inventory with health status
• Implement application whitelisting for critical systems
• Regular endpoint compliance scanning

MFA Enforcement (Article 21(2)(j))

• Deploy MFA for all remote access
• Enforce MFA for privileged accounts
• Implement MFA for access to critical systems and data
• Consider passwordless authentication where feasible
• Support hardware security keys (FIDO2/WebAuthn) for high-risk accounts