NISdirektiv

NISdirektiv, officially the NIS Directive or Directive (EU) 2016/1148, is an EU framework aimed at achieving a high common level of security for network and information systems across the Union. Adopted in 2016, member states were required to transpose the directive into national law by May 2018. The directive seeks to strengthen cybersecurity in critical sectors and to improve cooperation among public authorities and private operators.

The scope of the directive covers two main groups. Operators of essential services include organizations in energy, transport, banking and financial market infrastructure, health, drinking water, and digital infrastructure that are essential for society and the economy. Digital service providers include online marketplaces, search engines, and cloud computing services that meet certain thresholds. The directive assigns national authorities the responsibility to designate competent authorities, monitor compliance, and enforce security measures.

Key obligations for the covered entities include implementing appropriate and proportionate technical and organizational measures to manage risks to the security of network and information systems, and ensuring incident prevention and resilience. Incidents with significant impact must be reported to the relevant national authority or computer security incident response teams within a defined timeframe, enabling timely response and coordination.

The NIS Directive also established a framework for cooperation and information sharing at the EU level. This includes national CSIRTs, security incident response structures, and the NIS Cooperation Group, which facilitates cross-border coordination and exchange of best practices.

In the long term, the directive laid the groundwork for EU cybersecurity policy and informed later updates, such as the NIS2 Directive, which expands scope and strengthens supervisory powers.