he original NIS Directive, adopted in 2016, was a significant step forward in enhancing the cybersecurity posture of the EU. It established the first set of binding rules for cybersecurity across the Union, requiring member states to develop national strategies and imposing cybersecurity obligations on operators of essential services (OES) and digital serviceDigital service means any Information Society service, that is to say, any service normally provided for remuneration, at a distance, by electronic means and at the individual request of a recipient of services. For the purposes of this definition: (i) ‘at a distance’ means that the service is provided without the parties being simultaneously present; (ii) ‘by electronic means’ means that the service is sent initially and received at its destination by means of electronic equipment for the processing (including digital compression) and storage of data, and entirely transmitted, conveyed and received by wire, by radio, by optical means or by other electromagnetic means; (iii) ‘at the individual request of a recipient of services’ means that the service is provided through the transmission of data on individual request. - Definition according Article 1(1), point (b), of Directive (EU) 2015/1535 of the European Parliament and of the Council providers (DSPs). However, as cyber threats have evolved in complexity and scope, the limitations of the original NIS Directive became apparent.

NIS 2 represents the EU’s response to these evolving challenges. It not only updates the provisions of the original directive but also significantly expands its scope. The directive now covers additional sectors, including manufacturing, postal and courier services, waste management, and food production, among others. By broadening the range of sectors required to implement robust cybersecurity measures, NIS 2 ensures that a greater portion of the EU’s critical infrastructure is protected from cyber threats.

The impact of NIS 2 on organizations cannot be overstated. The directive’s expanded scope and stricter requirements compel companies to adopt a proactive, comprehensive approach to cybersecurity. Those in newly covered sectors must swiftly adapt, implementing robust risk management strategies, strengthening incident response protocols, and securing their supply chains. Compliance with NIS 2 is now crucial for maintaining business resilience and safeguarding against evolving cyber threats.

One of the most critical aspects of NIS 2 is its focus on supply chain security. In today’s interconnected digital ecosystem, the security of your organization is only as strong as the weakest link in your supply chain. NIS 2 recognizes this and places significant emphasis on ensuring that all suppliers and partners adhere to rigorous cybersecurity standards. This requires organizations to conduct thorough risk assessments of their supply chains, implement stringent cybersecurity measures, and continuously monitor for potential vulnerabilities.