Everything you need to know about the NIS 2 directive

The NIS 2 directive: a new framework for stronger cybersecurity

The NIS 2 directive, adopted by the European Union, aims to harmonize and strengthen the cybersecurity of companies and public administrations across Member States. Published in December 2022, it replaces the first NIS directive by broadening its scope and introducing stricter requirements to address a growing cyber threat. In France, the ANSSI (Agence nationale de la sécurité des systèmes d'information, the French national cybersecurity agency) is leading the transposition of this directive into French law, with the aim of better protecting critical infrastructure and increasing companies' resilience to cyberattacks.

For many business leaders, complying with this directive is an opportunity to strengthen their cybersecurity and increase the trust of their partners. As cybercrime intensifies, proactive anticipation becomes essential: prevention is better than cure, especially in a field where the slightest vulnerability can have serious consequences.

Which entities are covered by the NIS 2 directive?

Unlike the first NIS directive, which mainly targeted large companies and essential infrastructure, NIS 2 considerably broadens the range of entities concerned. Today, more than 10,000 entities in France are potentially affected, including mid-sized companies and local public administrations. The directive distinguishes between two categories of entities:

• Essential entities (EE): those that play a critical role in national or economic security, such as the energy, healthcare, transport and financial infrastructure sectors.
• Important entities (IE): those whose activities, although less critical, are essential to the proper functioning of the economy.

Companies will be identified as EE or IE based on their size, revenue and business sector, according to criteria set out as part of the national transposition.

To find out whether your company is covered by this directive, take the test.

The obligations of the NIS 2 directive

The directive imposes several obligations on the entities concerned in order to ensure a level of cybersecurity appropriate to the risks identified:

1. Cyber risk management: companies must adopt legal, technical and organizational measures to protect themselves against cyber risks. These measures include securing the networks and information systems used to provide essential services.
2. Information sharing and transparency: entities are required to communicate their security information to the ANSSI and to update it regularly. This ensures continuous monitoring and the sharing of knowledge about emerging threats.
3. Incident reporting: in the event of a major incident, companies must notify the ANSSI and provide detailed reports. This obligation is crucial for understanding and managing cyber incidents, enabling a rapid and coordinated response.
4. Penalties for non-compliance: the directive provides for financial penalties proportionate to the breaches committed by the entities concerned, of up to 2% of worldwide revenue for EEs and 1.4% for IEs. These penalties aim to ensure rigorous enforcement of the obligations.

A collaborative approach and support from the ANSSI

To facilitate the implementation of the directive, the ANSSI is consulting with the stakeholders concerned. It has also created the digital platform "MonEspaceNIS2" to help companies track and understand their obligations. This initiative demonstrates the ANSSI's commitment to supporting entities toward better compliance and robust cybersecurity.

Why the NIS 2 directive is an opportunity for companies

Although it may be seen as a regulatory constraint, the NIS 2 directive is in fact an opportunity to strengthen cybersecurity and build operational resilience. In a context where cyber threats are everywhere, complying with the directive is a way to strengthen partners' trust, improve competitiveness and reduce the risk of data loss or theft.

Given the rapid evolution of cyber threats, it is crucial for companies to develop a proactive cybersecurity strategy. The NIS 2 directive thus makes it possible to reach a common standard across Europe, ensuring better collective protection and greater stability for the single market.

To learn more about the NIS 2 directive and how it affects your company, visit the official French government website: https://monespacenis2.cyber.gouv.fr/directive.

At Leasetic, we understand the importance of securing your information systems in light of new cybersecurity requirements. Our experts are available to support you in integrating environmentally friendly IT solutions that comply with current regulations. Contact us today for personalized support.

‍