NIS 2 Foundation flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

NIS 2 Directive number

Directive (EU) 2022/2555, adopted on 14 December 2022, replaced NIS 1 (Directive (EU) 2016/1148) and had a transposition deadline of 17 October 2024 for Member States.

Essential entity definition

A large entity in an Annex I sector, or a qualified trust service provider, TLD registrar, DNS provider, or public electronic communications provider, subject to proactive supervision under NIS 2.

Important entity definition

A large entity in an Annex II sector or a medium-sized entity in an Annex I sector, generally subject to reactive, ex-post supervision under NIS 2.

Size threshold rule

NIS 2 generally applies to entities with 50 or more staff or annual turnover or balance sheet above EUR 10 million, with exceptions for certain critical service providers regardless of size.

Annex I sectors

High-criticality sectors: energy, transport, banking, financial market infrastructure, health, drinking water, wastewater, digital infrastructure, ICT service management, public administration, and space.

Annex II sectors

Other critical sectors: postal and courier, waste management, chemicals, food, manufacturing, digital providers such as online marketplaces and search engines, and research organisations.

Member State entity list

Member States must establish a list of in-scope essential and important entities by 17 April 2025 and review it at least every two years.

DORA interaction

NIS 2 does not apply to financial entities covered by Regulation (EU) 2022/2554 (DORA), avoiding duplicate cybersecurity obligations for the financial sector.

Minimum harmonisation

NIS 2 sets a floor; Member States may adopt stricter national rules, so the applicable obligations depend on the transposing national law.

Article 21 measures

At least ten risk-management measures including risk analysis, incident handling, business continuity, supply chain security, encryption, access control, MFA, training, and effectiveness assessment.

Management body approval

The management body must approve the Article 21 risk-management measures and oversee their implementation, and may be held liable for infringements under national law.

Proportionality principle

Article 21 measures must be proportionate to the entity's exposure, size, and the likelihood and severity of incidents, rather than a fixed prescriptive checklist.

Supply chain security

Entities must address vulnerabilities specific to each direct supplier and service provider, and assess their overall quality and cybersecurity practices.

24-hour early warning

Entities must notify the CSIRT or competent authority of a significant incident without undue delay and in any event within 24 hours of becoming aware.

72-hour incident notification

A full incident notification must be submitted within 72 hours of becoming aware, assessing severity, impact, and indicators of compromise.

One-month final report

A final report on a significant incident must be submitted within one month, describing root cause, mitigation, and cross-border impact.

Significant incident criteria

An incident is significant if it causes or can cause severe operational disruption or financial loss, or considerable material or non-material damage to others.

Secure communications requirement

Article 21 requires secure voice, video, and text communications and emergency communication systems, plus multi-factor authentication and access control.

Management body training

Members of the management body must receive cybersecurity training, and Member States may require periodic training to ensure adequate oversight.

Proactive supervision

Essential entities face ex-post supervision including on-site inspections, audits, security scans, and information requests by competent authorities.

Reactive supervision

Important entities face supervision triggered by evidence, an incident, or a complaint, rather than routine proactive inspections.

Article 34 fines essential

Essential entities may be fined up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher, for NIS 2 infringements.

Article 34 fines important

Important entities may be fined up to EUR 7 million or 1.4% of worldwide annual turnover, whichever is higher, for NIS 2 infringements.

Binding instructions power

Competent authorities may issue binding instructions, order remedial measures, require independent audits, or appoint a monitoring officer to oversee compliance.

CSIRT role

Computer Security Incident Response Teams handle incident notifications, provide early warning and response, and participate in the CSIRT network and EU-CyCLONe.

Executive temporary ban

Member States may impose a temporary ban on executives from managerial functions for serious NIS 2 infringements by their entity.

Judicial review right

Supervisory decisions must be subject to effective judicial review before a court, ensuring entities can challenge penalties and instructions.

EU Cybersecurity Act schemes

European cybersecurity certification schemes under Regulation (EU) 2019/881 can demonstrate compliance with Article 21 measures; certification is voluntary unless made mandatory.

ENISA certification role

ENISA prepares candidate certification schemes, while the Commission adopts them by implementing act and national authorities oversee certification.

ISO/IEC 27001 baseline

ISO/IEC 27001 is a widely used information security management baseline that supports NIS 2 compliance but is not formally mandated by the directive.

Tabletop exercises

Simulated incident scenarios test response plans, decision-making, and communication, and are recommended good practice for NIS 2 readiness.

Compliance evidence types

Risk assessments, policies, incident logs, training records, audit reports, and management-body oversight records are typical evidence for supervisory review.