As head of cybersecurity within a large company, it is essential to stay up to date on IT security regulations that may affect our operations. One of these important regulations is the European Union’s NIS2 directive.
What is the NIS2 Directive?
The NIS directive – for Network and Information System Security, short for the Directive on the Security of Network and Information Systems – is a European Union legislation aimed at strengthening the security of networks and information systems within the EU. It is designed to ensure a high level of network and information system security in key sectors such as energy, transport, health, banking and financial services, as well as essential digital service providers.
At European level, this directive therefore aims to strengthen the level of cybersecurity of the economic and administrative fabric of each EU member country.
NIS2 is an evolution of the NIS1 directive, taking into account new threats and technological developments since its adoption in 2016. It introduces stricter requirements for network and information system security, as well as additional obligations for essential digital service providers and critical infrastructure operators.
The latest revisions of the European NIS2 directive
At the end of 2023, final clarifications were made to the NIS2 directive, and new revisions were adopted. These revisions strengthened companies’ obligations in the field of cybersecurity, by introducing more precise requirements regarding security incident management, notification of incidents to the competent authorities and cooperation between EU member states.
Among the main novelties of the NIS2 directive are:
- Expansion of the scope: The directive extends its scope to new sectors and online services, which means that more companies will be subject to its cybersecurity obligations.
In Europe, more than 10,000 entities have been identified for reinforced cyber oversight, across more than 18 sectors of activity.
In France, more than 600 entities will be concerned, divided between public entities mainly linked to the administration, and private ones, ranging from very small businesses/SMEs to CAC40 companies, according to ANSSI.
Want to know whether your organization is affected by the European NIS2 directive?
Create your NIS2 space and take the online test! You will then know whether you will have to register with ANSSI to enter the cyber scope under the NIS 2 directive. - Strengthened notification obligations: Companies are required to notify security incidents to their national authorities within stricter deadlines and with more detail, which aims to improve the response to cyberattacks and reduce risks for the whole EU.
- Strengthened cooperation between member states: The directive encourages greater cooperation and coordination between EU member states to deal with cross-border cyber threats, thereby strengthening digital security throughout Europe.
October 17, 2024 marks the national transposition deadline for EU member states.
NIS 2 will therefore come into force in France in the second half of 2024 at the latest.
However, under French law, the transposition due on October 17, 2024 is not enforceable until this directive is introduced by ANSSI (the National Agency for the Security of Information Systems) into national legislation.
The recent dissolution of the National Assembly and the delay in renewing our government have delayed this transposition, which appears to be postponed without any new deadline being announced.
It remains necessary to prepare right now since ANSSI plans a gradual upgrade to NIS2 until 2027, whose simplest obligations may have to be implemented very quickly (after the texts are adopted).
The next step will come in 4 months, on January 17, 2025, when member states will inform the European Commission of the rules and measures adopted.
Finally, April 17 will mark the deadline by which, on April 17, 2025, each member state establishes the list of regulated entities, divided into two categories: essential entities (EE) and important entities (IE).
The distinction into two categories of regulated entities makes it possible to define objectives adapted and
proportionate to the stakes of each of these categories.
The impact on French companies
For French companies, the NIS2 directive implies adapting to the new cybersecurity requirements and upgrading their IT security practices and infrastructures. Companies operating in essential sectors, such as banking, health, transport and energy, will be particularly affected by NIS2’s new obligations.
Learn more about the 18 sectors of activity concerned by NIS 2 via the MonEspaceNIS2 website.
In addition, French companies that provide essential digital services or operate critical infrastructure will have to comply with the directive’s specific requirements, which could require additional investments in information systems security and risk management.
The NIS2 directive represents an important step in promoting digital security in Europe, and its impact on French companies underlines the growing importance of cybersecurity in an increasingly interconnected and digital world. It is essential for companies to prepare now to comply with these new regulations and to strengthen their IT security posture to protect their activities and their customers against cyber threats.
To go further on the European NIS 2 directive, you can also consult the following links:
- Cyber.Gouv.fr – the NIS2 directive: https://cyber.gouv.fr/la-directive-nis-2
- Cyber.Gouv.fr – NIS2, what will change for French companies and administration: https://cyber.gouv.fr/directive-nis-2-ce-qui-va-changer-pour-les-entreprises-et-ladministration-francaises
To learn more about the update of NIST2 (Cybersecurity Framework – USA), see our blog article “NIST2, major update of the cybersecurity framework” by clicking here.
