NIS2 Directive Guide: Essential Cybersecurity Compliance for Businesses in 2024

Is your business prepared for the new era of EU cybersecurity regulation? The NIS2 Directive (Directive on measures for a high common level of cybersecurity across the Union), adopted in November 2022, significantly expands the scope and stringency of its predecessor, NIS1. With a compliance deadline of October 2024 for member states to transpose it into national law, now is the time to understand your obligations. This directive aims to create a uniform, high level of protection for critical infrastructure across the EU, enabling a faster response to cyber crises and data breaches. For businesses, this means broader coverage, more extensive duties, and enhanced supervisory powers for authorities. This guide breaks down what you need to know about cybersecurity compliance, risk management, and how it intersects with your cyber liability insurance.

Who is Affected by the NIS2 Directive? A Broadened Scope

The NIS2 Directive establishes a uniform EU-wide scope, capturing far more entities than before. Generally, it applies to medium and large companies that meet two of the following three criteria:

• Employ more than 50 people.
• Have an annual turnover exceeding €10 million.
• Operate within a designated critical sector.

There are very few exceptions. The directive distinguishes between "highly critical" sectors and "other critical" sectors, with slightly varying rules. This expansion means many previously unaffected companies in supply chains, manufacturing, and digital services will now fall under its mandate.

Hagen Küchler is a lawyer and certified data protection officer (DSC) at the FPS law firm. His consulting focus is on IT and data protection law.Hagen Küchler

Core Compliance Obligations: Building a Risk Management System

At its heart, NIS2 requires affected companies to manage risks to the security of their network and information systems. You must implement appropriate and proportionate technical, operational, and organizational measures. In practice, this is achieved through a detailed cybersecurity risk management system that must, at a minimum, cover:

• Risk Analysis & Policies: Implement policies on risk analysis, information security, and incident handling.
• Business Continuity: Establish business continuity and crisis management plans, including backup management.
• Supply Chain Security: Assess and manage cybersecurity risks in the supply chain and supplier relationships.
• Access Control & Encryption: Employ basic cyber hygiene practices: access control, multi-factor authentication, encryption, and secure communications.
• Vulnerability Management: Implement policies for vulnerability handling and disclosure.
• Training: Provide regular cybersecurity training for employees.

These requirements show significant overlap with existing frameworks like the GDPR and ISO 27001, which can streamline integration for many organizations.

Strict Incident Reporting and Management Accountability

NIS2 introduces stringent reporting timelines. In the event of a significant security incident impacting your services, you must:

1. Submit an early warning within 24 hours of becoming aware.
2. Provide a full incident report within 72 hours.
3. In severe cases, inform your service users about the incident and any protective measures they should take.

Critically, NIS2 emphasizes management accountability. The company's management bodies are responsible for overseeing the implementation of cybersecurity measures and can be held personally liable for violations. The exact nature of this liability will be defined by individual member states during national implementation.

Supervision and Sanctions: Powerful Enforcement Tools

National authorities will be equipped with extensive powers to enforce NIS2 requirements, which fall into three categories:

An important note: If a single act violates both NIS2 and the GDPR, the directive stipulates that it should be penalized only once under the regime that provides for the higher fine, preventing double jeopardy.

Actionable Steps and the Role of Cyber Insurance

With the October 2024 deadline approaching, proactive preparation is essential. The German Federal Office for Information Security (BSI) already offers resources that will likely be expanded, including catalogs of IT experts, information on basic cybersecurity measures, and incident response checklists.

For businesses, the path forward involves:

1. Conduct a Gap Analysis: Assess your current cybersecurity posture against NIS2 requirements.
2. Strengthen Risk Management: Formalize and document your risk management and incident response processes.
3. Review Supply Chains: Evaluate and contractually enforce cybersecurity standards with critical suppliers.
4. Train Your Team: Implement mandatory cybersecurity awareness training.
5. Review Your Insurance: Consult with your broker to ensure your cyber insurance policy aligns with NIS2 obligations. A robust policy can be a critical component of your risk transfer strategy, covering costs related to incident response, business interruption, regulatory fines (where insurable by law), and liability claims.

NIS2 represents a significant step toward a more secure digital future in Europe. While many requirements overlap with existing regulations, complacency is a major risk. The recent cyberattacks on municipalities and critical infrastructure underscore that the threat is present today. Proactive compliance is not just a legal obligation—it's a core component of modern business resilience and risk management.

Insurers and brokers struggle in claims management with high backlogs, rising claim frequencies, skilled labor shortages, and growing customer expectations. Manual processes are expensive and slow.