On October 17, 2024, the European Commission adopted its first Implementing Regulation under the NIS2 Directive (EU) 2022/2555 https://eur-lex.europa.eu/eli/dir/2022/2555 (the ”NIS2 Directive”), marking a significant step in enhancing the cybersecurity of critical entities and digital infrastructure across the EU.
The NIS2 Directive aims to establish a high level of cybersecurity across the EU, covering sectors vital to the economy and society, including public electronic communications services, ICT service management, healthcare, energy, transport, and public administration. It reinforces security measures, addresses supply chain vulnerabilities, streamlines reporting obligations, and introduces stricter enforcement mechanisms.
Additionally, the NIS2 Directive harmonizes sanctions across Member States and promotes cooperation on cyber crisis management at both the national and EU levels.
The NIS2 Directive primarily applies to companies providing key digital services, such as:
- Online marketplaces;
- Social networking platforms;
- Cloud computing;
- Data centers,or
- Search engines.
One of the NIS2 Directive’s notable provisions is the requirement for companies to report significant cybersecurity incidents within 24 hours to national authorities. An incident is deemed significant if it results in:
- Financial losses exceeding EUR 500,000 or 5% of turnover;
- Exfiltration of trade secrets;
- Major disruptions or risks to health and safety, or
- Repeated operational disruptions over a six-month period.
For example, a breach in cloud services impacting over 5% or 1 million users must be reported to the competent national authority.
As of October 18, 2024, all Member States are required to enforce the NIS2 Directive’s cybersecurity measures, including supervisory and enforcement provisions.
Impacted companies must ensure their Incident Response Plans are in line with these new requirements and be prepared to respond rapidly to any cybersecurity incidents.
Next Steps?
In the Grand Duchy of Luxembourg, the NIS2 Directive has not been transposed into national law yet. Draft bill 8364, which transposes the NIS2 Directive and proposes stricter obligations for affected entities, is still pending approval. The draft bill 8364 introduces measures such as:
- The requirement for entities to register with competent authorities;
- Implementation of cybersecurity risk management measures;
- Mandatory notification of significant incidents to authorities, and
- Active involvement of management bodies in executing the cybersecurity strategy.
