NIS2-directive

The NIS2 directive is the EU legislation on cybersecurity. It contains legal measures to increase the overall level of cybersecurity within the EU. The NIS2 directive must be transposed and in place by October 18, 2024. The directive requires you to have control over your suppliers' cybersecurity capabilities and cyber hygiene.

OneMore Secure has the controls in our service regarding the security measures you need to have in place. With OneMore Secure, you can conduct your GAP analysis of what you need to do to comply with the directive.


Check the counter below for the time you have left.

Countdown to October 18, 2024

Industries affected by NIS2

NIS2 is expanded from previous directives to cover significantly more industries.

Essential entities

Energy – Electricity, heating and cooling, Oil, Gas, Hydrogen

Transport – Air, Train, Water, Road

Bank – Credit institution, Financial market and infrastructure

Healthcare - healthcare providers, medical products, pharmaceuticals, medical equipment

Drinking water & Waste water

Digital infrastructure – Data centers, cloud providers, electronic communications

Public sector – National and regional authorities

Space

Important entities

Postal and courier services

Waste disposal

Manufacturing, production and distribution of chemicals

Production, processing and distribution of food

Manufacturing – Medical equipment, computer equipment, electronic equipment, machinery, motor vehicles, other transport

Digital providers – marketplaces, search engines, social platforms

Excluded Entities

Micro and small companies 

Municipalities (can however be incorporated through national NIS law)

Security measures

NIS2 strengthens the requirements for the cyber security of affected businesses and also introduces penalty fees for those who do not comply with the requirements. Here are some of the safety measures required:
  • Risk management and security policy

  • Incident management

  • Continuity planning and crisis management

  • Secure the supply chain

  • Secure Network & Information Systems (acquisition, development, maintenance, vulnerability and privacy)

  • Risk Management policy and processes

  • Cyber hygiene and cyber security training

  • Policy and processes for encryption

  • Authorization and access control

  • Authentication