NIS2 DIRECTIVE

What new cyber security laws mean for

industrial companies in Europe, and what
you need to do to get ready to comply

W H ITE PAP E R
NIS2 Directive

Contents

1. Introduction 4

2. Overview of NIS and NIS2 6

2.1 NIS2 main changes in a nutshell 7

2.2 NIS2 covers more sectors 7

2.3 NIS2 requirements on organizations, management, and supply chains 8

2.4 Why regulating supply-chain cyber security matters 8

2.5 NIS2 reporting obligations 8

2.6 Adoption timelines 9

3. Key steps for NIS2 readiness 10

3.1 Understanding the scope 10

3.2 Risk-based cyber security management systems 10

3.3 Documentation for demonstration 10

4. Conclusion 11

Appendix A: Table – NIS/NIS2 scope by sector/subsector 12

Appendix B: Abbreviations 13

This whitepaper was published in February 2023

2 3
NIS2 Directive

1. Introduction
Organizations providing essential services in the European Union (EU) NIS and industrial cyber security Management bodies of organizations in scope will become
The original NIS Directive’s stated aim was to ‘build cyber legally obliged and accountable for implementing cyber
will soon face tougher cyber security regulation than ever, with the threat security capabilities across the Union, mitigate threats to security requirements mandated by NIS2-related laws.
of more and greater fines and/or withdrawal of license to operate if network and information systems used to provide essential This raises the possibility that they could be fined and that
services in key sectors and ensure the continuity of such their managers, including c-suite, could be temporarily
they do not comply. This follows the January 2023 entry into force of a services when facing incidents, thus contributing to the barred from duties.
directive that the EU’s 27 Member States must transpose into national Union’s security and to the effective functioning of its
economy and society’. The EU’s Member States must ensure that management
laws by late 2024.1 The revised Directive on Security of Network and bodies comply; and as is the case with NIS, Member States
Information Systems (NIS2) builds on the NIS Directive (NIS)2 of 2016, Effectively, NIS was the first EU-wide framework to address can impose even stricter requirements than those in the
concern that threats to critical infrastructure cyber security NIS2 Directive for cyber security, monitoring, and reporting.
which has been in force in national regulations since 2018. are becoming more common, complex, and creative as Organizations’ cyber security teams, IT/OT managers,
digital transformation continues. Deeply digitally connected C-Suites and directors must understand the requirements.
infrastructure is critical to efforts to create more efficient
decentralized systems and cross-border networks of critical The clock is ticking on compliance
infrastructure within the EU. Companies working in energy, transport, health, space,
banking and other selected sectors with critical
NIS2 is NIS on steroids infrastructure need to start preparing.
NIS2 can be regarded as ‘NIS on steroids’ for an era in
which organizations operating essential services need more DNV estimates that organizations will have to start
than ever to manage the cyber risk of both their IT and complying with national laws incorporating NIS2
operational technology (OT), the control systems that requirements by mid-2024. So, the clock is already ticking
manage, monitor, automate and control industrial on what will be a lengthy risk assessment, management,
operations. Greater risk arises from greater connections and training challenge for many medium and large3
between OT/IT and externally through the internet. organizations within NIS2 scope.
NIS2 covers more sectors than NIS; see Appendix A for a
summary of those deemed ‘essential’ or ‘important’ services. Preparing for compliance will take many months and will be
Those defined as essential now include, for example, more complex for organizations operating across multiple
energy, transport, health, and digital infrastructure. Member States. Many organizations with industrial
operations will need to set plans in motion from early 2023.
While NIS was about establishing a framework for EU-wide
cyber security of essential services, NIS2 is about regulation This white paper summarizes the scope and requirements
and enforcement. of NIS2 and suggests how to prepare for compliance
following three key steps. We hope these insights from our
NIS2 strengthens requirements for cyber risk assessment team will be useful to you, and we welcome your comments
by essential and important organizations in the sectors and questions.
within its scope, and covers risk from supply chains and
supplier relationships. Jalal Bouhdada
Global Segment Director for Cyber Security, DNV
and Founder, Applied Risk

1. Directive (EU) 2022/2555, aka the NIS2 Directive, entered into force 16 January 2023, from which date Member States have 21 months to homologate it into national laws. 3. The EU defines ‘medium-sized enterprises’ as those that employ 50 to 250 persons and either have annual turnover not exceeding EUR 50 million, or an annual balance sheet
2. Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information not exceeding EUR 43 million. It defines large enterprises as employing more than 250. For definition of ‘persons employed'
systems across the Union. https://eur-lex.europa.eu/eli/dir/2016/1148/oj see https://ec.europa.eu/eurostat/statistics-explained/index.php?title=Glossary:Persons_employed_-_SBS

4 5
NIS2 Directive

2. Overview of NIS and NIS2

NIS applies to companies involved in or responsible The application of NIS provisions has been evolving 2.1 NIS2 main changes in a nutshell 6. Calls for tighter enforcement standards, more rigorous
for ‘essential services’ but leaves it to Member States to and changing across Member States depending on risk NIS2 seeks to correct shortcomings of the previous NIS oversight of national agencies, and more alignment
decide which organizations fall into this category. Energy, appetites, timing, and maturity. Enforcement of NIS is Directive, modernize it for the present, and ensure its of penalties policies among Member States.
drinking water supply and distribution, banking, transport, already in effect in certain countries such as Germany viability in the future. To achieve these goals, NIS2: Additionally, NIS2 strengthens the NIS Cooperation
and health are among the essential services providers (see France and UK while others are still working on this.4 Group’s7 influence over strategic policy choices and
Appendix A) within the scope of the NIS framework which: 1. Broadens the application of the current NIS Directive expands information exchange and cooperation
We are not aware of any penalties arising so far from by including new sectors (see Section 2.2) based on among Member State authorities. The new directive
1 Defines ‘essential services’ and sets thresholds non-compliance with the original NIS framework. how important they are to the economy and society, also improves operational coordination, notably in
for them However, we are certain that the EU is very serious about and by introducing a clear size cap, which includes all terms of managing cyber crises.
2 Requires a notification process to be in place for compliance and that the threat of fines and/or loss of medium and large businesses in some sectors. NIS2 7. Creates an EU registry in this area, run by ENISA, and
cyber incidents license to operate are very real under NIS2. also gives Member States significant latitude in sets a fundamental framework with accountable key
3 Requires relevant organizations to demonstrate identifying smaller organizations with a high security actors on coordinated vulnerability disclosure for
compliance with additional cyber security controls. The upside is that the two directives help to focus risk profile. Additionally, NIS2 ends the distinction recently discovered vulnerabilities throughout the EU.
organizations on the need to do something about between digital services providers (DSPs) and
compliance and on thinking about the financial, technology, operators of basic services. According to their 2.2 NIS2 covers more sectors
and human resources they need to allocate to OT/IT cyber importance, entities will be categorized into essential The broader scope of NIS2 defines more sectors as
security and resilience. and important categories and divided into subgroups ‘essential services’, or sectors of ‘high criticality’, that must
that would be subject to various types of oversight. implement cyber security risk management and prove that
A study published by Applied Risk, a DNV company, in 2. Establishes requirements for ‘management body’ they are doing so (see Appendix A). This impacts on
2021 reveals that compliance with standards or oversight and accountability for security risk medium and large organizations. The EU also lists
regulations is the primary driver of investment in OT management. Establishes a risk management ‘important services’ protected under NIS2, which could be
security programmes.5 According to DNV research of 940 method stipulating a minimal set of fundamental redefined as ‘essential’ in the future. Organizations not in
energy professionals in 2022, less than half (47%) believe security features that must be used, strengthening NIS2 scope include central banks, parliaments, and those
their OT cyber security is as strong as their IT security.6 and streamlining security and reporting requirements engaged in defence, law enforcement, the judiciary, and
Correspondingly, four in 10 (38%) admit that they have not for businesses. national and public security. Member States must establish
invested as much as they need to in OT cyber security. 3. Adds more specific guidelines for incident reporting, a list of essential and important entities as well as entities
report content, and delivery schedules. These providing domain name registration services.
require the implementation of a stricter incident
response process. It should be noted that Appendix A includes broad
4. Adjusts fines and penalties for non-compliance. headings and that there is more nuanced detail in both NIS
5. Suggests forcing individual businesses to address and NIS2 about what is, what is not, and what could be, in
cyber security risks in supply chains and supplier scope in some of the sectors/subsectors covered by the
partnerships to address the security of these ties. directive. We recommend seeking advice on this aspect as
The idea improves supply-chain cyber security for it becomes clearer what will be in scope in national laws
important information and communication technology homologating NIS2 while applying local variations.
at the European level. Building on the successful
strategy used in the framework of the European
Commission’s Recommendation on Cybersecurity,
Member States may conduct coordinated risk
assessments of vital supply chains in collaboration
with the Commission and the European Union
Agency for Cybersecurity (ENISA).

4. At the time of writing, it is unclear if the UK, no longer within the EU, will intentionally and/or specifically reflect any or all of the EU’s NIS2 requirements in the UK’s own Network
and Information Systems Regulations, which are being updated.
5. ‘Architecting the Next Generation for OT Security’, Applied Risk, November 2021,
https://applied-risk.com/resources/press-release-architecting-the-next-generation-for-ot-security-report-released
6. The Cyber Priority’, DNV, May 2022, download at https://www.dnv.com/cybersecurity/cyber-insights/thecyberpriority.html 7. The Network and Information Systems Cooperation Group was established by the first NIS Directive to ensure cooperation and information exchange among EU Member States.

6 7
NIS2 Directive

2.3 NIS2 requirements on organizations, Only 33% of OT professionals say their organizations This means that organizations with OT/IT within scope must
management, and supply chains conduct regular audits of their own main suppliers, and have or develop compliant incident response processes
To reduce discrepancies in cyber security resilience across only 27% conduct due diligence prior to contracting with that report incidents within prescribed deadlines (Section
in-scope industries, NIS2 aspires to a more coordinated new suppliers. Just half (49%) of OT security professionals 3.2). This could be quite challenging for OT companies as
cyber security management approach. To control the risks say their contracts with suppliers include cyber many do not yet include incident response as part of daily
presented to the security of those entities' network and security requirements. security routines despite it being a critical aspect of
information systems when providing their services, NIS2 cyber security.10
recommends seven fundamental steps that all essential Research conducted by DNV in 2022 reveals that 28% of
and important entities shall implement: energy professionals working with OT say their company 2.6 Adoption timelines
is making the cyber security of their supply chain a high Organizations should now think about NIS2's scope and if
1. Risk analysis and information system security policies; priority for investment.9 This contrasts with the 45% of their operations fit within it. An organization should think
2. Incident handling (prevention, detection, and OT-operating respondents who say expenditure in IT about the organizational, financial, and technical actions
response to incidents); system upgrades is a high investment priority. that will be necessary to get ready for NIS2 compliance if it
3. Business continuity and crisis management; determines that it is likely to fall under the new legislation's
4. Supply chain security, including security-related 2.5 NIS2 reporting obligations purview. For instance, the European Commission
aspects of relationships between each entity and (i) NIS2 aims to boost information sharing and anticipates that organizations' ICT security spending will
its suppliers, or (ii) service providers (such as data collaboration on managing cyber crises between increase by up to 22% in the first few years following the
storage providers and processing services or Member States at EU level. It mandates a greater degree introduction of NIS2 (a maximum increase of 12% is
managed security services providers); of EU-wide harmonization of reporting obligations for anticipated for organizations already covered by the
5. Security in network and information systems organizations within scope and for national cyber security present NIS Directive). In-scope organizations should also
acquisition, development and maintenance, including incident response teams (CSIRTs) or, where applicable, monitor how NIS2 is implemented in the important EU
vulnerability handling and disclosures; competent authorities. jurisdictions where they conduct business.
6. Policies and procedures to assess the effectiveness of
cyber security risk management measures; and For example, NIS2 obliges organizations to issue ‘without Organizations that provide products or services
7. The use of cryptography and encryption. undue delay and in any event within 24 hours of becoming related to information and network security should also be
aware of the significant incident, an early warning, which, ready for due diligence from in-scope NIS2 organizations.
Fortunately, most of these security controls are not where applicable, shall indicate whether the significant Therefore, in preparation for any such due diligence, such
brand-new, and many businesses are likely already incident is suspected of being caused by unlawful or out-of-scope organizations should make sure that efficient,
engaged in these fields. We anticipate that key malicious acts or could have a cross-border impact’. documented processes are in place to handle security risks
performance indicators for these controls will emerge related with their product or service offering.
in due course from the EU. Within 72 hours of becoming aware of the significant
incident, the organization must file an incident notification The European Parliament approved NIS2 on 10 November
2.4 Why regulating supply-chain cyber security matters updating if applicable the first information and indicating 2022 and the directive came into force on 16 January 2023,
The inclusion of supply chain cyber security is timely and an initial assessment of the significant incident, including from which date Member States have 21 months to
important. It will drive a much-needed change in the its severity, impact and, where available, the indicators of homologate it into national laws. It is unlikely to be ratified
mindsets of organizations when it comes to cyber risk compromise. The national CSIRT or competent authority and legally incorporated into the national legislation of all
management. Most OT security professionals say their can request a more detailed follow-up report one month EU Member States until the end of 2024 at the earliest.
organizations are at risk because of their inability to after the 72-hour notification.
ascertain the security practices of relevant third parties and
to mitigate cyber risks across the OT external supply chain,
according to research conducted by Applied Risk in 2021.8

8. ‘Architecting the Next Generation for OT Security’, Applied Risk, November 2021,
https://applied-risk.com/resources/press-release-architecting-the-next-generation-for-ot-security-report-released 10. ‘Cyber Security Incident Response & Decision-making strategies in OT environments’, Applied Risk, Blog [online], 08 June 2022,
9. ‘The Cyber Priority’, DNV, May 2022, download at https://www.dnv.com/cybersecurity/cyber-insights/thecyberpriority.html https://applied-risk.com/resources/blog-cyber-security-incident-response-ot-environments

8 9
NIS2 Directive

3. Three key steps to prepare

for NIS2-based regulation 4. Conclusion
We advise any organization now beginning to consider To protect networks and systems, and their physical Despite being a relatively new regulatory obligation, NIS Developing a culture of security and compliance involves
how to prepare to comply with regulation based on NIS2 environment, against incidents, such measures must take has many elements that were already defined in best adequately funding and resourcing sustainable and
to follow these three practical steps for success: a risk-based approach. In addition to this broad need, the practices (e.g. standards and frameworks such as IEC long-term security improvement. This should focus on an
new Directive includes more specific information on cyber 62443, NIST, ISO27001) and have been included in approach based on risk and consequences. This approach
• Step1: know from the start which systems are within security risk management methods, specifying that they compliance requirements for sectors like financial in turn involves diversifying controls and activities to include
scope for NIS2-based regulations (Section 3.1) shall include at least the following: services and telecoms for more than 20 years. Investment offensive capabilities, training and simulation, monitoring
• Step 2: adopt risk-based cyber security management • A governance and operating model with clear roles and in comprehensive IT and OT security programmes based on and testing.
and enforce security controls (Section 3.2) responsibilities and senior management accountability; established cyber security standards and frameworks can
• Step 3: document everything needed to demonstrate • Risk analysis and information system security policies; enable organizations to address risks covered by NIS and The requirements for evidence of compliant policy being in
compliance with controls (Section 3.3). • Incident handling; other legislation. They also enable businesses with place and adhered to should be consistent, enforced on all
• Business continuity, such as backup management and industrial operations to reduce downtime and improve users, and current (version control is needed). Technical
3.1 Understanding the scope disaster recovery, and crisis management; resilience. Having better security will also secure valuable and organizational cyber security controls should ensure
Deciding what OT/IT systems are within scope for NIS2 • Supply-chain security including security-related aspects business models, and future-proof organizations. compliance with policies and be subject to review,
is the initial step towards successful compliance. Key concerning the relationships between each entity and performance assessment, and compliance assessment. The
questions include: its direct suppliers or service providers; In parallel, preparing for NIS2 can be seen as a wider good news is that all of this is achievable given sufficient
• What essential services is the organization providing? • Security in network and information systems opportunity to review and fix cyber security to future-proof time, resources, and with buy-in from the boardroom down.
• Does or might the organization fall within the scope acquisition, development and maintenance, including OT/IT across the organization and its supply chains. The
of NIS2? vulnerability handling and disclosure; opportunity is to embed robust cyber security practices
• What new requirements would need to be • Policies and procedures to assess the effectiveness vital to organizations’ digital transformations while also
NEED ADVICE?
implemented by the organization within NIS2 scope? of cyber security risk management measures; building regulatory compliance into operations.
• If the organization is not itself directly within NIS2 • Basic computer hygiene practices and cyber
DNV’s experts are on hand to help your business
scope, does it deal with suppliers or customers subject security training;
identify relevant NIS2 requirements, and put
to the new rules? • Policies and procedures regarding the use of
measures in place to comply.
• What obligations do organizations need to attribute cryptography and, where appropriate, encryption;
to their suppliers or business customers in their • Human resources security, access control policies,
Contact us at: www.dnv.com/cybersecurity
contractual arrangements? and asset management; and
• The use of multi-factor authentication or continuous
As a result, understanding the regulatory requirements will authentication solutions, secured voice, video and
be important for organizations not directly impacted by text communications, and secured emergency
the new Act. It will also be important to determine whether communications systems within the entity, where
any additional local IT/OT security regulations need to be appropriate.
adopted because of any national regulations.
3.3 Documentation for demonstration
3.2 Risk-based cyber security management systems Compliance requires documentation – if it is not
Essential and important entities within the scope of NIS2 documented, it did not happen. Auditors can ask for a
will be required to take appropriate technical, operational, wide range of documentation in assessing organizations
and organizational measures to manage the risks posed to for proof of compliance with NIS2. This step can be
the security of the IT/OT assets they use for their operations overwhelming especially for organization that are just
or providing services. They will also need to prevent or starting their compliance journey. A holistic governance
minimize the impact of incidents both on people who use systems can not only aid in tracking progress and
their services and on other services. improving documentation, it can also provide a
multi-disciplinary perspective and a solid framework
of how companies can manage cyber threats in a
pro-active manner and work towards counteracting cyber
threats both now and in the future.

10 11
NIS2 Directive

Appendix A Appendix B
TABLE: NIS AND NIS 2 SCOPE BY SECTOR AND SUBSECTOR ABBREVIATIONS

CSIRT: Computer security incident response team

NIS DIRECTIVE ANNEX II NIS2 DIRECTIVE ANNEX I

Essential services and Digital Service Providers Essential services DSP: Digital service provider
• Energy – electricity, oil, natural gas • Energy – electricity, district heating and cooling, oil, natural
gas, hydrogen ENISA: The European Union Agency for Cybersecurity
• Drinking water supply and distribution
• Transport – air, rail, water, road • Manufacture of pharmaceutical products including vaccines
IEC: International Electrochemical Commission
• Banking • Drinking water and waste water

• Financial market infrastructures • Transport – air, rail, water, road

ISO: International Organization for Standardization
• Health – health care settings including hospitals and • Banking (except for central banks)
private clinics • Financial market infrastructures IT: Information technology
• Digital Infrastructure – internet exchange points (IXPs), DNS • Health
service providers, TLD name registries • Digital infrastructure – internet exchange points (IXPs), NIS: Network and Information Systems Directive (EU) 2016/1148
• Public administrations identified as operators of DNS providers, TLD name registries, cloud computing
essential services service providers, data centre service providers, content NIS2: Second Network and Information Systems Directive (EU) 2022/2555
delivery networks, trust service providers, public
electronic communications networks, electronic NIST: (US) National Institute of Standards and Technology
communications services
• ICT service management (business-to-business) OT: Operational technology
• Space industry
• Central and regional public administrations, though
Member States can if wished regulate local authorities’
cyber security

Important services (NIS2 Directive Annex II)

• Postal and courier services
• Waste management
• Chemicals – manufacture, production, distribution
• Food – production, processing, distribution
• Manufacture of medical devices (but these can be
redefined as essential services during a public
health emergency)
• Manufacture of computers, electronic and optical products,
electrical equipment, machinery and equipment, and motor
vehicles and other transport equipment
• Digital providers – online marketplaces, online search
engines, and social networking service platforms

12 13
ABOUT DNV

DNV is an independent assurance and risk management provider, operating

in more than 100 countries. Through its broad experience and deep
expertise, DNV advances safety and sustainable performance, sets industry
standards, and inspires and invents solutions.

DNV combines specialist energy industry knowledge with engineering

expertise and information system best practice to keep critical infrastructure
projects and operations confidently cyber secure. We provide many of the
sector’s most successful and forward-thinking companies with clear and
practical advice to uncover their risks, build a powerful force of defence
against threats, recover from attacks, and unite stakeholders behind security
programmes that everyone can believe in.

dnv.com/cybersecurity

Disclaimer
All information is correct to the best of our
knowledge. Contributions by external authors
do not necessarily reflect the views of the
editors and DNV AS.

17680_JSW.30.01 2023