The European Commission proposed rules on the cyber security of network and information systems called NIS 2 Directive, in effect expanding the scope of the current rule known as NIS Directive.
The new rules cover all medium and large companies in essential sectors – energy, transport, banking, financial market infrastructure, health, vaccines and medical devices, drinking water, waste water, digital infrastructure, public administration, and space.
All medium and large firms in postal and courier services, waste management, chemicals, food manufacturing, medical devices, computers and electronics, machinery equipment, motor vehicles, and digital providers such as online marketplaces, online search engines, and social networking service platforms will also fall under the rules.
The companies are required to assess their cyber-security risk, notify authorities and take technical and organisational measures to counter the risks, with fines up to 2% of global turnover for non-compliance. EU countries and EU cyber-security agency ENISA could also assess the risks of critical supply chains under the rules.
Every day we send out a free e-mail with the most important headlines of the last 24 hours.
Subscribe now