The European Parliament and Council’s NIS2 directive enters into force today. Member states must put it into national law by 17 October 2024 and apply national measures from 18 October.
Photo: European flags. © Håkan Dahlström, Spain, 2010 (CC BY 2.0, via Wikimedia Commons). Resized and cropped.
The framework covers specified sectors, including cloud and data-centre providers, generally medium-sized and larger entities, with size-independent inclusions and exemptions. It sets proportionate cybersecurity duties including supplier security and incident handling.
For significant incidents, reporting must begin without undue delay: an early warning within 24 hours of awareness, followed by notification within 72 hours. Trust-service incidents have a 24-hour notification exception. A final report follows within one month of notification, or a progress report if the incident continues.
Significance includes severe operational disruption or financial loss, or considerable harm to others, including potential impacts. The original NIS directive remains until 18 October 2024.
Source: EUR-Lex.
Discover more from Sulat AI & Tech News
Subscribe to get the latest posts sent to your email.
.jpg){kind=link}