NISdirektiivin

The NIS Directive, officially the Directive on security of network and information systems, is a European Union directive that aims to enhance the cybersecurity of critical infrastructure and digital services within member states. It was adopted in 2016 and entered into force in August 2016, with member states having 21 months to transpose its provisions into national law. The NIS Directive is the first piece of EU-wide cybersecurity legislation and represents a significant step towards a harmonized approach to cybersecurity resilience across the Union.

The primary objective of the NIS Directive is to ensure a high common level of security for network and information systems across the EU. It achieves this by imposing cybersecurity obligations on two main categories of entities: operators of essential services (OES) and digital service providers (DSP). OES include entities operating in sectors such as energy, transport, banking, financial market infrastructures, healthcare, and digital infrastructure. DSPs encompass online marketplaces, search engines, and cloud computing services.

Under the directive, these entities are required to take appropriate technical and organizational measures to manage risks to the security of their network and information systems and to prevent and minimize the impact of incidents affecting them. This includes measures such as risk assessment, incident handling, business continuity, and security in supplier relationships. Furthermore, the NIS Directive establishes a framework for cooperation between member states and the European Commission, including the creation of CSIRTs (Computer Security Incident Response Teams) and a Cooperation Mechanism to facilitate information sharing and coordinated responses to cybersecurity threats. The directive is currently being revised into NIS2, which aims to broaden its scope and strengthen its provisions.