The EU's NIS2 Directive

The NIS 2 Directive classifies organizations into two distinct categories, i.e., Essential entities, which include health, energy, and infrastructure organizations & Important entities, encompassing sectors that are vital for societal functions but are not classified as Essential entities, such as digital services, finance, and postal services;

Cloud computing services, data centers, content delivery networks, and managed service providers are all covered under the NIS2 Directive's scope as Important entities;

Organizations must report any cybersecurity incidents that can have a significant impact on the provision of their services within 24 hours of becoming aware of that incident;

Non-compliance with the NIS2 Directive by essential entities can lead to fines of at least €10 million or 2% of the global annual turnover of the company, whichever is higher;

Non-compliance with the NIS2 Directive by important entities can lead to fines of at least €7 million or 1.4% of the global annual turnover of the company, whichever is higher;

Member states may impose a periodic penalty to ensure essential and important entities cease their infringements;

Each EU member state must create or designate at least one or more national competent authorities to oversee the implementation of the NIS2 Directive and its relevant provisions;

The European Cyber Crises Liaison Organization Network (EU-CyCLONe) is established to ensure better coordination of efforts and responses to major cybersecurity incidents that may affect multiple EU member states;

The Cooperation Group is established to ensure better coordination of efforts among EU member states related to the implementation of the NIS2 Directive and other information-sharing practices;

All EU member states must create or designate at least one or more Computer Security Incident Response Teams (CSIRTs), which can be established within another competent authority to facilitate and promote information exchange with third countries' national computer security incident response teams, using relevant information-sharing protocols, including the traffic light protocols;

All EU member states must regularly assess their national cybersecurity strategies, at least every five years, using key performance indicators and updating them if necessary. 

The European Union Agency for Cybersecurity (ENISA) may assist the EU member states in both the development and updates of their national cybersecurity strategy and performance indicators for the assessment of that strategy.