Remain safe from possible cyber threats becoming compliant with the NIS 2 regulation

The Network and Information Security Directive aims to improve the collective cybersecuity of Member States by protecting critical organizations and infrastructures from cyber threats.

Obligated entities must implement technical, operational, and organizational measures to manage the security risks of networks and information systems.

The NIS 2 directive establish mandatory and sanctionable cybersecurity measures, requires risk management and the reporting of incidents within 24 hours of detection.

To fulfil its objective, the directive focuses on organizations that operate in critical sectors, as they are essential for the proper functioning of society and, for this reason, are often the primary target of cyber-attacks. It will impact over 100.000 organizations.

Companies are in the scope If they provide services or carry out activities in any country in the European Union, count with more than 50 employees and obtain 10 million euros in annual revenue and operate in any of the 18 sectors listed as critical.

By 2025, Member States will establish a list of essential and important entities, which is how NIS 2 defines companies and other organizations that must comply with it.

Essential critical sectors

1. Energy
2. Transport
3. Banking
4. Financial market infrastructures
5. Health
6. Drinking wáter
7. Waste water
8. Digital infrastructure
9. ICT service management (business-to-business)
10. Public administration
11. Space

Other critical sectors

1. Postal and courier services
2. Waste management
3. Manufacture, production and distribution of chemicals
4. Production, processing and distribution of food
5. Manufacturing
6. Digital providers
7. Research