NIS2 is an extended continuation of the NIS Directive. Its goal is to align cybersecurity regulations across EU member states and improve cooperation between authorities responsible for this area. The creation of NIS2 arose from significant discrepancies among member states regarding the requirements of the NIS Directive and the entities covered by it. It was noted that not all entities of strategic importance to cybersecurity systems were obligated to implement the provisions of NIS.

As a result, the NIS2 Directive expands the range of entities subject to the requirements of the national cybersecurity system and the scope of their obligations. NIS2 also introduces a new division into essential and important entities, as well as expands the list of key sectors and types of activities. The new obligations will include:

• Regular cybersecurity audits and risk assessments;
• Regular cybersecurity tests and training;
• Implementation of appropriate measures for managing cybersecurity risk;
• Keeping records of the cybersecurity measures in place;
• Reporting cybersecurity incidents to relevant authorities and providing information on identified threats that could have led to an incident;
• Cooperation with other entities covered by the new directive, as well as with supervisory authorities, to exchange information related to cybersecurity.

Essential and important entities will generally include large and medium-sized companies, but in exceptional cases, the directive may also apply to small and micro enterprises. Almost the entire catalog, except for digital service providers, of important entities is new and includes: the production and distribution of chemicals; the production, processing, and distribution of food; postal and courier services; waste management; the production of medical, optical, computer, electronic products, and motor vehicles.

The directive takes a risk-based approach. Entities required to comply with the provisions must assess the risk within the organization and take appropriate measures proportional to the risk of a cybersecurity incident. Failure to meet the specified requirements will result in severe consequences. For essential entities, the maximum fine will be at least 10 million euros or 2% of the total annual turnover of the enterprise in the previous financial year, whichever is higher. For important entities, the fines will be lower but still strict. Therefore, it is important to be aware of the broad range of supervisory measures, which will include inspections, audits, security scans, or requests to provide evidence of cybersecurity policy implementation. Entities will not only have to meet the requirements but also be able to demonstrate compliance with them.