The NIS 2 Directive: A New Era of Cybersecurity in the EU

The NIS 2 Directive extends cybersecurity obligations to new sectors and more entities. Poland did not implement the rules by the deadline (October 2024), but the directive’s requirements already affect how you should manage IT security, report incidents and oversee your supply chain. This guide explains which organizations the rules cover, what obligations they impose and what you can do to prepare.

Why NIS 2 matters to your business

The number of cyberattacks is rising rapidly. Their effects reach real operations, from disruptions to energy supplies and interruptions to healthcare services to leaks of customer data. NIS 2 responds to these threats by regulating not only large corporations but also smaller entities operating in sectors vulnerable to attacks.

Implementing NIS 2 in Poland

The NIS 2 Directive (Network and Information Security) is an updated version of the original NIS Directive from 2016. Its aim is to raise the level of cybersecurity in Europe by expanding the scope of regulation and tightening obligations.

Current implementation status

• The implementation deadline expired in October 2024.
• Poland did not meet that deadline. An amendment to the Cybersecurity Act is still in progress.
• This means Poland remains behind the EU requirements, although the direction of change has been settled.

Regardless of the status of Polish legislation, it is worth preparing your organization now, before the rules take effect.

Who is covered by the NIS 2 Directive?

The rules cover a broad range of public- and private-sector entities. The directive divides them into two categories:

• Essential entities, such as energy, transport and healthcare providers.
• Important entities, such as financial institutions, telecommunications companies, postal services, and food producers and processors.

The rules mainly cover medium-sized and large companies, but they also reach smaller entities if their activities matter to digital security.

Sectors covered by the rules

1. Energy: generation, transmission and distribution of electricity, gas and oil.
2. Transport: operators of road and rail infrastructure, ports and airports.
3. Healthcare: hospitals, medical facilities, laboratories and medical technology providers.
4. Finance and banking: financial institutions, banks and payment service providers.
5. IT service providers: cloud services, hosting and IT infrastructure management.
6. Drinking water and wastewater management: organizations responsible for water supply and wastewater treatment.
7. Public administration: national and local government offices that process data and provide administrative services.

Exclusions

The directive excludes micro and small enterprises, with one exception: when their activities are important to critical infrastructure. For example, a small IT company that supports hospital IT systems may be covered by the rules despite its small size.

When NIS 2 applies to micro, small and medium-sized enterprises

Although many smaller companies are not directly subject to NIS 2, the directive covers them in three situations:

1. Designation as an essential or important entity: the Ministry of Digital Affairs may recognize a company as necessary to society or the economy, for example in connection with critical infrastructure.
2. A role in the supply chain: if your company provides services or products to essential or important entities, you must implement appropriate security measures even if the directive does not cover you directly.
3. Meeting sector-specific criteria: if you provide services in a sector covered by the directive, such as digital infrastructure or medical device manufacturing, you may be designated as an essential or important entity.

For example, a company that supplies water and treats wastewater in large cities performs activities needed to provide essential public services.

How to check whether the directive applies to your company

Check three things:

1. Sector: whether your company operates in a sector listed in Annex I or II to NIS 2.
2. Size: whether you employ more than 50 people or have annual turnover above EUR 10 million or a balance sheet total above EUR 43 million.
3. Supply-chain role: whether you provide services to essential or important entities.

If you meet conditions 1 and 2, you are highly likely to need to comply with NIS 2. If you meet condition 3, check whether your contractors require you to implement specific security standards.

The main changes introduced by NIS 2

Expanded sectoral scope

NIS 2 imposes cybersecurity obligations on industries that were not previously covered by the rules. More companies in energy, transport, healthcare and finance must meet specified protection standards.

Classification as essential or important entities

Essential entities, for example in the energy sector, must meet stricter requirements. Important entities face a less stringent regime but still have risk-management and reporting obligations.

Stricter cybersecurity requirements

• Greater focus on protecting the entire supply chain.
• An obligation to monitor and secure IT systems in a way that maintains operational continuity.
• A requirement to use modern methods of defense against cyberattacks.
• Stronger information duties toward supervisory authorities.

New incident-reporting obligations

Companies and institutions must promptly notify supervisory authorities about cyberattacks and threats that affect the stability of their systems. This requires procedures for detecting and reporting incidents shortly after they occur.

High penalties for violations

Companies may face fines of up to several million euros. For large companies, penalties may be expressed as up to 2% of annual turnover.

Business obligations under NIS 2

Ongoing risk analysis

Conduct continuous risk analysis that accounts for both current and emerging threats. Update your security strategies as threats evolve by responding to new types of attacks, changing hacker techniques and new system vulnerabilities.

IT systems security policy

Implement an IT systems security policy. The ISO 27001 standard can help. It sets out principles for creating, implementing and maintaining an information security management system (ISMS), which helps identify threats and implement countermeasures.

Cyber incident management

Develop an incident-management system with three levels:

1. Prevention: updating software, securing systems and educating employees.
2. Detection: monitoring systems, intrusion detection systems (IDS) and event logging.
3. Response: business continuity plans (BCPs), communication with stakeholders and post-incident analysis.

Reporting incidents to CSIRT

Report cyber incidents to computer security incident response teams (CSIRTs), which coordinate responses to attacks, within 24 hours after detecting a serious incident that affects the organization’s continuity of operations.

Supply-chain security

Increase oversight of subcontractors and digital service providers. Monitor, assess and control risks related to external partners, from equipment suppliers to IT service companies. Implement procedures that ensure information security throughout the supplier ecosystem.

What this means in practice

Every organization covered by NIS 2 must take four groups of measures:

1. Develop policies and procedures to identify, assess and reduce risks related to cyber threats.
2. Implement incident-reporting procedures: report every serious incident to supervisory authorities within 24 hours.
3. Apply technical measures, such as:
   • installing firewalls,
   • using intrusion-detection software,
   • conducting regular security audits,
   • providing employees with cybersecurity training.
4. Implement organizational measures: a risk-management strategy that covers both prevention and incident response.

What are the consequences of noncompliance?

• Financial fines of up to several million euros, depending on the type of violation, such as failure to manage risks, failure to report an incident on time or failure to implement safeguards.
• Penalties calculated as a percentage of turnover: for large companies, they may amount to up to 2% of annual turnover.
• Loss of trust among clients and business partners.

How to prepare for NIS 2: an action plan

1. Conduct a cybersecurity audit: identify threats in your company and security gaps.
2. Train employees: make sure everyone in the company knows how to recognize and respond to cyber threats.
3. Develop incident-reporting procedures: prepare a plan that enables you to report incidents to the appropriate authorities within 24 hours.
4. Get help from specialists: consider working with cybersecurity experts who can help your organization adapt to NIS 2 requirements.

What to do now

The EU deadline for implementing NIS 2 passed in October 2024. Even if Polish rules have not yet been enacted, the direction of change has been settled. Lack of preparation means a risk of financial penalties as well as losing the trust of contractors and clients.

If you are unsure about the scope of your obligations:

1. Check whether your company meets the criteria for being covered by the directive.
2. Conduct a risk analysis and update your security policies.
3. Implement incident-monitoring and response systems.
4. Contact a law firm or cybersecurity expert to assess your organization’s situation.

Want to learn more? Contact our law firm. We can help prepare your organization for NIS 2 requirements.

Frequently asked questions

How can I check whether the NIS 2 Directive applies to my company?
Check three things: whether you operate in a sector listed in Annex I or II to NIS 2, such as energy, transport, healthcare, finance or IT services; whether you employ more than 50 people or have annual turnover above EUR 10 million or a balance sheet total above EUR 43 million; and whether you provide services to essential or important entities. If you meet the first two conditions, you are highly likely to need to comply with NIS 2. If you meet the third, check whether your contractors require you to implement specific security standards.

Can a small or medium-sized company be covered by NIS 2 even if it is not a large organization?
Yes, in three situations: when the Ministry of Digital Affairs designates it as an essential or important entity because of its significance to critical infrastructure; when it provides services or products to essential or important entities as part of the supply chain; or when it meets sector-specific criteria, such as operating in digital infrastructure or medical device manufacturing. For example, a small IT company that supports hospital IT systems may be covered by the rules despite its small size.

What obligations does NIS 2 impose on companies in practice?
NIS 2 requires four groups of measures: developing cyber-risk policies and procedures; implementing procedures for reporting serious incidents to CSIRT within 24 hours; applying technical measures such as firewalls, intrusion-detection systems, regular audits and employee training; and implementing organizational measures covering prevention and incident response. A separate obligation is supply-chain security oversight: you must monitor and assess risks related to subcontractors and digital service providers.

When must a serious incident be reported to CSIRT under NIS 2?
You must report a serious incident that affects the organization’s continuity of operations to CSIRT within 24 hours after detecting it. This requires preparing incident-detection and reporting procedures in advance so your company can meet the deadline.

What penalties can a company face for noncompliance with NIS 2?
Fines may reach several million euros, and for large companies penalties may amount to up to 2% of annual turnover, depending on the type of violation, such as failure to manage risks, failure to report an incident on time or failure to implement safeguards. Financial penalties are not the only risk. The company may also lose the trust of clients and business partners, directly affecting its market position.