Assistance et solutions pour la Directive NIS2

L'Union européenne a adopté une nouvelle législation en matière de cybersécurité, la directive « Sécurité des réseaux et de l'information 2 » (NIS 2). Cette directive constitue une amélioration significative par rapport à la directive NIS existante, puisqu'elle impose aux États membres de l'UE d'adopter et d'appliquer rigoureusement des règles plus strictes en matière de cybersécurité.

Délais: D'ici le 17 octobre 2024, les États membres doivent adopter et publier les mesures nécessaires pour se conformer à la directive NIS2. Ils appliqueront ces mesures à partir du 18 octobre 2024.

Le champ d'application de la directive NIS2 couvre toutes les organisations, y compris les entreprises et les fournisseurs, qui jouent un rôle crucial dans le bon fonctionnement de l'économie et de la société européennes en fournissant des services essentiels ou importants. Si votre organisation relève de l'une des catégories suivantes et répond aux critères suivants (plus de 50 employés et un chiffre d'affaires supérieur à 10 millions d'euros), la conformité à la directive NIS2 devient obligatoire.

Public and private entities in specific sectors:

• Postal and courier services
• Waste management
• Chemicals
• Food
• Manufacturing of medical devices
• Computers and electronics
• Machinery equipment
• Motor vehicles
• Energy
• Transport
• Banking
• Financial market infrastructures
• Healthcare
• Drinking water supply and distribution
• Digital infrastructures
• Online marketplaces
• Online search engines
• Cloud computing services

The new NIS2 Directive aims to enhance the resilience and incident response capabilities of both the public and private sectors. The directive specifically focuses on combatting cybercrime and improving both European and national cybersecurity management.

The NIS2 Directive was published in the Official Journal L333 of the European Union on December 27, 2022. It entered into force on January 16, 2023 – the twentieth day following its publication.
Member States were required to transpose the directive into national law within 21 months of its entry into force, meaning the transposition deadline was October 17, 2024.
As of 2025, the implementation of the NIS2 Directive across Member States is at varying stages – most have already transposed the directive, while others are still working on it.

The management bodies of essential and important entities approve the cybersecurity risk management measures taken by those entities to comply with the NIS2 minimum cybersecurity risk management measures (Article 21). They oversee their implementation and can be held liable for violations of this article by the entities.

Members of the management bodies of essential and important entities are required to undergo training, and shall encourage essential and important entities to provide similar training to their employees on a regular basis.

NIS2 is an updated version of NIS that provides improved guidance and clarity on the EU’s cybersecurity requirements. It expands the scope of essential and important entities, specifies management liabilities, outlines how controls should be carried out, and addresses how breaches should be reported. For the first time, directors are liable with their personal assets if they fail to comply with legal requirements. In summary, NIS2 is an enhanced version of NIS that offers more comprehensive and detailed cybersecurity guidelines.