NIS2direktiivit

NIS2direktiivit, officially known as Directive (EU) 2022/2555, is a legislative act adopted by the European Parliament and the Council of the European Union to strengthen the overall level of cybersecurity across the Member States. It builds upon the original NIS Directive (Directive (EU) 2016/1148), which was the first EU-wide policy on information society security. The new directive was adopted on 26 December 2022 and entered into force on 5 February 2023, with a compliance deadline for Member States that lasted until 17 February 2025.

The directive aims to address the evolving threat landscape by setting out a more comprehensive framework for risk management and incident reporting. Its scope now includes providers of essential services such as energy, transport, health, and digital infrastructure, as well as providers of digital services including online marketplaces, search engines, and cloud computing services. Entities not previously covered by the original NIS Directive are now obliged to implement security measures, conduct risk assessments, and report significant incidents within 24 hours.

Core provisions of NIS2direktiivit cover governance of cybersecurity, supply chain risk management, and information sharing. It introduces an EU-wide supervisory board and enlarges the powers of national authorities to impose fines and sanctions. The directive also encourages the development of a common language of cybersecurity measures, facilitating mutual assistance among Member States and ensuring that new technologies are integrated with robust security controls.

Implementation of the directive has prompted Member States to revise national legislation, often enacting stricter penalties and expanding the list of obligated entities. The directive is expected to enhance resilience against cyberattacks, improve incident response coordination, and promote a higher level of trust in digital services across the Union.