The protection of critical infrastructure is to apply from 17 October 2024
With the NIS-2 Directive, the EU aims to protect critical infrastructure in Europe. The directive must be transposed by the individual EU member states by 17 October 2024.
Who has to implement NIS-2?
The directive defines a total of 18 sectors. Companies that provide or carry out their services within the EU and operate in one of these sectors are affected.
Thresholds: entities in a total of 18 sectors with at least 50 employees or an annual turnover and an annual balance sheet total of at least €10 million fall within the scope of NIS-2.
| Employees | Turnover | Balance sheet |
| 1 - 50 | And €10m to €50m | Or up to €43m |
| 50 - 250 | And up to €50m | And €10m to €43m |
| At least 250 | Or at least €50m | And at least €43m |
Essential entities
- Operators of critical facilities (KRITIS) are considered “essential entities”.
- Entities, for example, for domains, DNS, qualified trust services, larger telecommunications providers.
- Entities with 50 or more employees or with more than €10 million in annual turnover and €10 million in annual balance sheet total that operate in sectors 1 (sectors of high criticality) and 2 (other critical sectors).
Important entities
- Entities with 250 or more employees or more than €50 million in annual turnover and €43 million in annual balance sheet total that operate in sector 1.
Other entities (regardless of size)
- Providers of public electronic communications networks or of publicly available electronic communications services, trust service providers
- TLD name registries and DNS service providers (except operators of root name servers)
- Sole providers that are essential for society and the economy
- Entities whose failure would have a major impact on public order, safety or health
- Entities whose failure could lead to a systemic risk with cross-border consequences
- Entities that are critical because of their particular national or regional importance
- Public administration entities of central government defined by the EU member state, or critical public administration entities at regional level
- Critical infrastructure in accordance with Directive (EU) 2022/2557
- Entities that provide domain name registration services
- In addition, the new directive also applies indirectly to service providers and suppliers of the entities concerned.
Sectors of high criticality
- Energy (electricity, district heating and cooling, oil, gas and hydrogen)
- Transport (air, rail, water and road transport (authorities))
- Banking
- Financial market infrastructures
- Health
- Drinking water
- Waste water
- Digital infrastructure
- ICT service management
- Public administration
- Space
Other critical sectors
- Postal and courier services
- Waste management
- Manufacture, production and distribution of chemicals
- Manufacturing (manufacture of medical devices and in vitro diagnostic medical devices, of computers, electronic and optical products, of electrical equipment, mechanical engineering, manufacture of motor vehicles, trailers and semi-trailers and of other transport equipment)
- Digital providers
- Research
Obligations
a) Identification and registration of critical services, facilities or components with the German Federal Office for Information Security (BSI).
b) Setting up a point of contact for critical areas and providing proof of it to the BSI. The point of contact must be reachable at all times and report significant incidents to the BSI.
c) Significant incidents in critical areas must be reported to the BSI without undue delay after the incident has been detected. The principle “speed before completeness” applies. The reporting process is divided into four stages:
- Initial report within 24 hours of becoming aware of the incident
- Confirmation within 72 hours of becoming aware of the incident
- Optional interim reports
- Final reports within 30 days of the confirmation
d) Information security management system (ISMS): Cyber risks must be managed through an ISMS. Standards for risk management include, for example, ISO 3100 or ISO 27005, or BSI Standard 200-3.
e) KRITIS management: Affected organisations should set up central coordination, steering and control of their NIS-2 obligations.
f) Business continuity management and IT emergency management: Emergency management for critical areas must follow suitable standards, for example BSI Standard 200-4.
g) Supplier and service provider management: Risks within supply chains and purchasing must be assessed.
h) Implementation of the state of the art: To ensure the level of security within critical areas, measures must be implemented in line with the state of the art.
i) System for continuous attack detection: Critical areas must have suitable attack detection in place.
Conclusion
NIS-2 regulates risk management and creates an understanding of information security. It is about understanding and limiting possible threats to information security. Key elements of implementation are an asset list and the analysis of the risks to which assets are exposed. These risks must be minimised through protective measures.
In the event of security incidents, companies are obliged to report them to the BSI and to deal with threats effectively and quickly. To do so, an ISMS should be introduced and emergency preparedness established.
NIS-2 is to apply from 18 October 2024.
Source
This news article comes from our partner company bbg bitbase group.
