The final form of NIS2 was published in the Official Journal of the EU on 27 December 2022 in all official languages. Since it is a directive, individual Member States are responsible for its transposition into their laws. The deadline for Member States to do so is 17 October 2024.

Although this deadline may not be fulfilled, it is crucial to start the compliance journey as soon as possible, keeping in mind that, compliance processes, including security assessments, auditing, consulting, and tool implementations take several months and are rather demanding.

The new rules formulated in the directive apply to any regulated service providers not only from the EU but also those operating in the EU. There are two entity categories that NIS2 distinguishes between – Essential entities operating in sectors such as public administration, digital infrastructure, energy, finance, transport; and Important entities providing services in e.g., waste management, research, manufacturing. In total, there are more than 18 sectors impacted by NIS2, as it adds additional rules and obligations for businesses in four primary areas, including risk management, corporate accountability, business continuity, and reporting.

Subjects to which NIS2 is applicable will be required to implement measures to address specific forms of cyberthreats and minimize their impact; to ensure the management body oversees, approves, and is properly trained in the area of cybersecurity; to set up processes for reporting of security incidents with significant impact on service provision or recipients; as well as to develop a comprehensive business continuity plans preparing the given entity for major cyber incidents.