Provisional agreement by the Council and the European Parliament

On 13th May 2022, the Council and the European Parliament agreed on measures for a high common level of cybersecurity across the European Union, to further improve the resilience and incident response capacities of both the public and private sector and the EU as a whole. Once adopted, the new directive, called ‘NIS2’, will replace the current directive on security of network and information systems (the NIS directive).

NIS2 will set the baseline for cybersecurity risk management measures and reporting obligations across all sectors that are covered by the directive, such as energy, transport, health and digital infrastructure. The revised directive aims to remove divergences in cybersecurity requirements and in implementation of cybersecurity measures in different member states. To achieve this, it sets out minimum rules for a regulatory framework and lays down mechanisms for effective cooperation among relevant authorities in each member state. It updates the list of sectors and activities subject to cybersecurity obligations, and provides for remedies and sanctions to ensure enforcement.

Discover more here.

Source: European Council