NIS2: who is affected and where to start?
The European NIS2 directive greatly expands the number of organisations subject to cybersecurity obligations. Here are some pointers to find out whether you are affected and how to prepare, without replacing a professional's analysis.
Kayzen Security editorial team4 min read
What the directive provides
Adopted on 14 December 2022, the NIS2 directive replaces the 2016 NIS directive. It requires the entities concerned to take cybersecurity risk management measures (article 21) and to report significant incidents (article 23), and it makes management bodies accountable: they must approve these measures and undergo training (article 20).
In France, transposition takes place through a law and implementing texts. Their progress and the dates of entry into force should be checked on the ANSSI website at the time you read this guide.
Am I affected? The three criteria
- The sector: the directive lists 11 “sectors of high criticality” (annex I: energy, transport, banking, health, water, digital infrastructure, public administration, space…) and 7 “other critical sectors” (annex II: postal services, waste management, chemicals, food, manufacture of certain products, digital providers, research). For the financial sector, the DORA regulation (UE) 2022/2554 takes precedence for risk management and incident reporting.
- The size: as a general rule, medium-sized companies (at least 50 employees, or turnover and a balance sheet total exceeding €10 million) and large companies in these sectors; the headcount and figures of linked or partner enterprises may have to be added together.
- Size exceptions: some entities are covered regardless of their size, notably providers of public electronic communications networks or services, trust service providers, top-level domain name registries and DNS service providers, as well as, depending on national designation, an entity that is the sole provider of an essential service in the country.
- Local authorities and public administrations may be covered depending on national transposition.
Essential entities and important entities
Both categories must apply the same types of measures, but supervision differs: ex ante checks are possible for essential entities, ex post for important entities. The directive also sets higher caps on administrative fines for essential entities. The amounts applicable in France depend on the transposition law.
The article 21 measures, in summary
- Risk analysis and security policies.
- Incident handling.
- Business continuity, backups and crisis management.
- Supply chain security.
- Security in the acquisition, development and maintenance of systems, including vulnerability management.
- Assessment of the effectiveness of the measures.
- Basic cyber hygiene and training.
- Cryptography and encryption.
- Human resources security, access control and asset management.
- Multi-factor authentication and secured communications.
Reporting significant incidents
The directive provides for an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours, then a final report no later than one month after that notification. These reports are sent to the CSIRT or the competent authority. This means knowing how to detect an incident, how to assess it and who the right contact is in advance.
Where to start
- Check your situation using ANSSI's online service and have the analysis confirmed by a professional.
- Take inventory of your systems, your data and your service providers.
- Put basic hygiene measures in place: updates, two-factor authentication, offline backups, controlled administrator accounts.
- Write an incident management and reporting procedure.
- Involve senior management, which must approve the measures and undergo training.
This guide summarises directive (UE) 2022/2555 for information purposes. It does not constitute legal advice: whether you are subject to it and what your obligations are must be validated by a professional, based on the transposition text in force and information from ANSSI. A tool like Kayzen can contribute to the measures of article 21; it does not make an organisation compliant.
Official sources
- ANSSI (new tab) — Espace NIS 2 : test d'éligibilité et informations sur la transposition
- EUR-Lex (new tab) — Directive (UE) 2022/2555 (NIS 2), Journal officiel de l'Union européenne
- ANSSI (new tab) — Agence nationale de la sécurité des systèmes d'information — guides et publications
The resources cited are published by their authors in their original language. Kayzen is not affiliated with any of these organisations.
This guide is general and for information only. It does not replace legal advice or the help of an IT security professional.