Network and Information Security Directive 2
EU cybersecurity directive expanding mandatory security and incident reporting across more sectors.
Sectors
Banking & FinanceDigital InfrastructureEnergy & UtilitiesHealthcare & PharmaIT & CybersecurityPublic SectorTelecommunicationsTransport & LogisticsWastewaterWater SupplyChemicalsFood & AgricultureManufacturingSpaceWaste Management
Articles (46)
Article 1 — Subject matterArticle 2 — ScopeArticle 3 — Essential and important entitiesArticle 4 — Sector-specific Union legal actsArticle 5 — Minimum harmonisationArticle 6 — DefinitionsArticle 7 — National cybersecurity strategyArticle 8 — Competent authorities and single points of contactArticle 9 — National cyber crisis management frameworksArticle 10 — Computer security incident response teams (CSIRTs)Article 11 — Requirements, technical capabilities and tasks of CSIRTsArticle 12 — Coordinated vulnerability disclosure and a European vulnerability databaseArticle 13 — Cooperation at national levelArticle 14 — Cooperation GroupArticle 15 — CSIRTs networkArticle 16 — European cyber crisis liaison organisation network (EU-CyCLONe)Article 17 — International cooperationArticle 18 — Report on the state of cybersecurity in the UnionArticle 19 — Peer reviewsArticle 20 — GovernanceArticle 21 — Cybersecurity risk-management measuresArticle 22 — Union level coordinated security risk assessments of critical supply chainsArticle 23 — Reporting obligationsArticle 24 — Use of European cybersecurity certification schemesArticle 25 — StandardisationArticle 26 — Jurisdiction and territorialityArticle 27 — Registry of entitiesArticle 28 — Database of domain name registration dataArticle 29 — Cybersecurity information-sharing arrangementsArticle 30 — Voluntary notification of relevant informationArticle 31 — General aspects concerning supervision and enforcementArticle 32 — Supervisory and enforcement measures in relation to essential entitiesArticle 33 — Supervisory and enforcement measures in relation to important entitiesArticle 34 — General conditions for imposing administrative fines on essential and important entitiesArticle 35 — Infringements entailing a personal data breachArticle 36 — PenaltiesArticle 37 — Mutual assistanceArticle 38 — Exercise of the delegationArticle 39 — Committee procedureArticle 40 — ReviewArticle 41 — TranspositionArticle 42 — Amendment of Regulation (EU) No 910/2014Article 43 — Amendment of Directive (EU) 2018/1972Article 44 — RepealArticle 45 — Entry into forceArticle 46 — Addressees
Controls that address this (22)
EU_NIS2-CTRL-001 - Daily safeguarding reconciliationoperational · critical priority · Daily reconciliation between safeguarded customer balances, core ledger balances and safeguarded bank accounts. Variances above EUR 100 mustEU_NIS2-CTRL-002 - Critical ICT incident reportingoperational · critical priority · All major ICT incidents impacting payment services, customer data or availability must be classified within 4 hours and reported under DORA EU_NIS2-CTRL-003 - GDPR breach notification workflowoperational · critical priority · Personal data breaches must be assessed within 12 hours and reported to the Belgian DPA within 72 hours where risk to data subjects exists.