The EU Network & Information Security 2 (NIS 2) Directive: a GRC approach with the main related ISO standards

22 May 2024 06:08 PM By itSMF Staff

Reading time: ~ 2 min.

The EU Network & Information Security 2 Directive (NIS 2)

Our today post is focused primarily on the Directive (EU) 2022/2555, the Network and Information Security directive issued by the European Parliament and the European Council, which is knowns also as the «NIS 2».

The NIS 2 Directive is focused on measures for a high common level of cybersecurity across the Union, and especially:

amending the Regulation (EU) No. 910/2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC;
amending the Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 establishing the European Electronic Communications Code (Recast)Text with EEA relevance;
repealing the Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union.

We remember that this NIS 2 Direct (date 14 December 2022) entered into force on 13th January 2023 and its implementation in national regulation must be done on 17th October 2024 at the latest.

As an European Directive, it lays down the results or goals that each Member State must achieve, however it is up to the single country to devise their own laws on how to reach these results or goals.

Where does the EU Network & Information Security 2 Directive (NIS 2) apply?

The NIS2 applies to all the sectores that the law defines «critical», such as:

📘 energy;

📘 public services;

📘 financial services;

📘 health services;

📘 telecommunications;

📘 space;

📘 public administration;

📘 ect.

The EU Network & Information Security 2 Directive (NIS 2) structure

The Directive (EU) 2022/2555 on Network & Information Security (NIS 2) is divided in the following chapters:

🔖Whereas (144)

🔖 Chapter I: general provisions

🔖Chapter II: coordinated cybersecurity frameworks

🔖Chapter III: cooperation at union and international level

🔖Chapter IV: cybersecurity risk-management measures and reporting obligations

🔖Chapter V: jurisdiction and registration

🔖Chapter VI: information sharing

🔖Chapter VII: supervision and enforcement

🔖Chapter VIII: delegated and implementing acts

🔖Annex I: sectors of high criticality
🔖Annex II: other critical sectors

How can we manage the compliance with all the requirements set by NIS 2? Our solution is a GRC Approach: let's take a closer look in the chapter below.