NIS2 Regulations: Obligations and requirements for companies

NIS2 is an update to the European Union’s first cybersecurity regulation, the NIS Directive, in force in Spain since 2021, through Royal Decree 43/2021, which regulates the security of networks and information systems in companies in essential sectors.

These regulations were created to improve security in essential sectors and protect European society and the economy from increasingly complex and frequent digital threats.

The NIS2 Directive introduces stricter cybersecurity requirements, including more sectors and actors, establishes shorter deadlines for incident notification, and strengthens sanctions for companies that do not comply with the regulations.

NIS2 applies to companies and entities in essential sectors such as energy, transport, financial services, health, and water supply, among others. It also affects digital service providers such as cloud services and data exchange platforms. You can consult the detailed list here.

The main requirements include the implementation of appropriate cybersecurity measures, the notification of security incidents within 24 hours, the designation of those responsible for the security of the network and information systems, and the performance of regular security audits. You can consult a list of the main obligations of NIS2 here.

The NIS2 Directive considers systemic risk, which means that small companies, with fewer than 50 employees, if they play a critical role in the supply chain, must also adapt to NIS2.

With NIS2, you have the responsibility to assess and manage risks not only in your own company, but also in your supply chain. That is, even if your operations are under control, a failure in one of your suppliers may put the supply chain at risk, like a domino effect.

Therefore, if your company belongs to one of these sectors considered essential, it is recommended that you get up to date with NIS2, regardless of your number of employees, as you run the risk that one of your clients will ask you to prove that you meet their minimum security requirements to continue working with you.

Companies that do not comply with the requirements established by NIS2 may face significant financial penalties and, in serious cases, the interruption of their commercial activities. Fines can reach up to 2% of their global annual turnover.

Under NIS2, security incidents that affect the availability, integrity, or confidentiality of essential services must be reported to the competent authorities. This includes cyberattacks, security breaches, and any other incident that may affect the provision of essential or trusted services.

Yes, NIS2 requires companies to provide ongoing cybersecurity training to their staff. This includes both employees and managers, in order to ensure that everyone understands the security policies and procedures.

Service providers that are subcontracted by companies in essential sectors must also comply with the requirements of NIS2. Companies must ensure that their service providers comply with cybersecurity regulations to protect the supply chain. You can read more information about it here.

Companies must implement risk-based cybersecurity measures, including access controls, intrusion detection and prevention systems, cryptography, vulnerability management, audits, and incident response plans, among others.

Compliance with NIS2 is supervised by the national cybersecurity authorities of each country. In Spain, the draft Law on Coordination and Governance of Cybersecurity has been approved and the foundations have been laid for the National Cybersecurity Center, which is key to managing crises and coordinating national strategies.

This draft law also aims to strengthen collaboration between Interior, Defense and Digital Transformation to ensure a comprehensive response to cyber threats.