NIS 2 Directive | security-incidents.de

NIS2 NIS 2 Directive

Directive (EU) 2022/2555 of the European Parliament and of the Council

of 14 December 2022

on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)

(Text with EEA relevance)

46 articles, 144 recitals and three annexes. Select an entry from the table of contents.

Chapter I · General provisions

Art. 1Subject matter Art. 2Scope Art. 3Essential and important entities Art. 4Sector-specific Union legal acts Art. 5Minimum harmonisation Art. 6Definitions

Chapter II · Coordinated cybersecurity frameworks

Art. 7National cybersecurity strategy Art. 8Competent authorities and single points of contact Art. 9National cyber crisis management frameworks Art. 10Computer security incident response teams (CSIRTs)Art. 11Requirements, technical capabilities and tasks of CSIRTs Art. 12Coordinated vulnerability disclosure and a European vulnerability database Art. 13Cooperation at national level

Chapter III · Cooperation at Union and international level

Art. 14Cooperation Group Art. 15CSIRTs network Art. 16European cyber crisis liaison organisation network (EU-CyCLONe)Art. 17International cooperation Art. 18Report on the state of cybersecurity in the Union Art. 19Peer reviews

Chapter IV · Cybersecurity risk-management measures and reporting obligations

Art. 20Governance Art. 21Cybersecurity risk-management measures Art. 22Union level coordinated security risk assessments of critical supply chains Art. 23Reporting obligations Art. 24Use of European cybersecurity certification schemes Art. 25Standardisation

Chapter V · Jurisdiction and registration

Art. 26Jurisdiction and territoriality Art. 27Registry of entities Art. 28Database of domain name registration data

Chapter VI · Information sharing

Art. 29Cybersecurity information-sharing arrangements Art. 30Voluntary notification of relevant information

Chapter VII · Supervision and enforcement

Art. 31General aspects concerning supervision and enforcement Art. 32Supervisory and enforcement measures in relation to essential entities Art. 33Supervisory and enforcement measures in relation to important entities Art. 34General conditions for imposing administrative fines on essential and important entities Art. 35Infringements entailing a personal data breach Art. 36Penalties Art. 37Mutual assistance

Chapter VIII · Delegated and implementing acts

Art. 38Exercise of the delegation Art. 39Committee procedure

Chapter IX · Final provisions

Art. 40Review Art. 41Transposition Art. 42Amendment of Regulation (EU) No 910/2014 Art. 43Amendment of Directive (EU) 2018/1972 Art. 44Repeal Art. 45Entry into force Art. 46Addressees

Preamble

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 114 thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the European Central Bank¹,

Having regard to the opinion of the European Economic and Social Committee²,

After consulting the Committee of the Regions,

Acting in accordance with the ordinary legislative procedure³,

HAVE ADOPTED THIS DIRECTIVE:

OJ C 233, 16.6.2022, p. 22.

OJ C 286, 16.7.2021, p. 170.

Position of the European Parliament of 10 November 2022 (not yet published in the Official Journal) and decision of the Council of 28 November 2022.

Signatures

Done at Strasbourg, 14 December 2022.

For the European Parliament

The President

R. Metsola

For the Council

The President

M. Bek

Document version

Official Journal version of 27 December 2022

Chapter I (Art. 1–6)General provisions

Chapter II (Art. 7–13)Coordinated cybersecurity frameworks

Chapter III (Art. 14–19)Cooperation at Union and international level

Chapter IV (Art. 20–25)Cybersecurity risk-management measures and reporting obligations

Chapter V (Art. 26–28)Jurisdiction and registration

Chapter VI (Art. 29–30)Information sharing

Chapter VII (Art. 31–37)Supervision and enforcement

Chapter VIII (Art. 38–39)Delegated and implementing acts

Chapter IX (Art. 40–46)Final provisions