The NIS2 directive: Strengthening cybersecurity against cybercrime

In 2024, cybercrime has escalated to an all-time high, impacting governments and industries globally and threatening the security of critical data and infrastructure. According to a report by Cybersecurity Ventures, cybercrime costs are expected to reach $10.5 trillion annually by 2025, up from $3 trillion in 2015{{Footnote.A74148}}.

This surge is driven by increasingly sophisticated cyberattacks, ransomware incidents, and data breaches, with the frequency and severity of attacks growing each year. The World Economic Forum's Global Risk Report 2023{{Footnote.A74149}} highlights that cyber threats are among the top global risks, emphasising the urgent need for robust cybersecurity measures.

To combat this escalating threat, the European Union has introduced the NIS2 Directive, a significant update to the original NIS Directive (Network and Information Systems Directive) of 2016, with increased scope covering more critical infrastructure and providers of essential services.

The NIS2 Directive aims to strengthen cybersecurity for critical infrastructure across the EU, ensuring more resiliency and stronger protections against data breaches and disruptions caused by bad actors.

Security expert David Clarke explains the key differences between NIS and NIS2

Scope and coverage: The original NIS Directive primarily focused on operators of essential services and digital service providers. NIS2 expands its scope to include medium and large entities from a broader range of sectors, including healthcare, transportation, energy, banking, and government. This means more organisations and government entities are now required to comply with stringent cybersecurity standards.

Security requirements: NIS2 introduces more detailed security requirements. Organisations must implement risk management measures, conduct regular security assessments, and adopt incident response strategies. The directive mandates the use of encryption and access controls to protect sensitive data.

Incident reporting: The original NIS Directive required entities to report significant incidents without undue delay. NIS2 tightens this requirement, mandating that incidents be reported within 24 hours of detection, ensuring a faster response to attacks and associated disruptions.

Supervision and enforcement: NIS2 strengthens the role of national authorities in supervising and enforcing compliance. Penalties for non-compliance are also more severe, with fines potentially reaching up to €10 million or 2% of the global annual turnover of the company, whichever is higher.

Supply chain security: NIS2 emphasises the importance of securing the critical supply chain, requiring companies and governments to assess and manage the cybersecurity risks posed by their suppliers and service providers.

Who will be affected?

The expanded scope of NIS2 means that a wide range of sectors will be affected. These include energy, transport, banking, financial market infrastructures, healthcare, drinking water supply and distribution, digital infrastructure, governments, and the aerospace sector. Medium and large enterprises within these sectors must ensure compliance with the new directive starting on 17th October 2024.

Potential fines and penalties

Non-compliance with the NIS2 Directive can result in substantial fines. Organisations that fail to meet the required standards or do not report incidents promptly can face penalties of up to €10 million or 2% of their global annual turnover. These stringent penalties highlight the importance of adhering to the directive to avoid financial and reputational damage.

Not in the EU?

Even those who are not based in the EU are impacted by NIS2. If your organisation operates in, or with any EU entity – you are subject to these regulations – and any subsequent penalties for non-compliance.