NIS2 NIS 2 Directive

NIS 2 Directive – Recitals

Recitals (1–50)

1Cybersecurity capacities, essential services, continuity of services 2NIS Directive, progress, need for reform 3Digital transformation, cyber threats, internal market 4National differences, cross-border services, harmonisation 5Minimum rules, cooperation, replacement of NIS1 6Extended scope, sectors, entities 7Scope, size-cap rule, small enterprises 8Public administration, security functions, exclusions 9National security, exemptions, confidential information 10Nuclear energy, national security, nuclear value chain 11Trust services, security functions, closed systems 12Postal services, courier services, postal delivery chain 13Excluded entities, cybersecurity, equivalent measures 14Data protection, privacy, supervisory authorities 15Essential entities, important entities, differentiated supervision 16Partner enterprises, linked enterprises, independence 17Existing operators of essential services, classification 18List of entities, registration, contact details 19Entity counts, Commission, sector-specific information 20Microenterprises, small enterprises, application guidance 21Complex business models, scope, proportionality 22Sector-specific acts, coherence, implementing acts 23Sector-specific requirements, equivalence, precedence 24Incident notifications, immediate access, single entry point 25Sector-specific supervision, cooperation between authorities, access to information 26Significant cyber threats, voluntary notification, situational awareness 27Sectoral acts, definitions, enforcement 28Financial sector, DORA, sector-specific rules 29Aviation, security requirements, cooperation between authorities 30Critical entities, CER Directive, physical security 31Digital infrastructure, physical security, CER boundary 32DNS services, TLD name registries, root name servers 33Cloud computing, service models, deployment models 34Edge computing, distributed cloud services, emerging models 35Data centre services, cloud distinction, in-house data centres 36Research organisations, applied research, commercial use 37Sector interdependencies, cascading effects, cross-border risks 38Competent authorities, national structures, supervision 39Single point of contact, cross-border cooperation 40Single points of contact, forwarding notifications, cross-sector cooperation 41CSIRTs, technical capacities, functional separation 42CSIRT infrastructure, staffing, confidentiality 43Vulnerability scans, data protection, CSIRT support 44CSIRT monitoring, internet-connected assets, vulnerabilities 45International CSIRT networks, third countries, data exchange 46Authority resources, CSIRT funding, performance of tasks 47CSIRTs network, operational cooperation, trust 48Cybersecurity strategy, objectives, priorities 49Cyber hygiene, basic safeguards, ENISA assessment 50Awareness, connected devices, cyber hygiene

Recitals (51–100)

51Artificial intelligence, research, data protection 52Open source, open standards, security through transparency 53Smart cities, connected utilities, cybersecurity strategy 54Ransomware, attack models, national strategy 55Public-private partnerships, knowledge sharing, crisis preparedness 56SMEs, support, supply chain risks 57Active cyber protection, prevention, defensive measures 58Vulnerability handling, coordinated disclosure, remediation 59International standards, best practices, risk management 60Vulnerability research, disclosure policy, liability risks 61Vulnerability disclosure, CSIRT coordinator, cooperation 62European vulnerability database, disclosure, mitigation 63ENISA database, CVE, international repositories 64Cooperation Group, strategic cooperation, work programme 65Cooperation Group, guidance, national experience 66Cooperation Group, stakeholders, threat landscape 67Staff exchanges, authorities, CSIRTs 68EU crisis framework, cooperation networks, EU-CyCLONe 69Large-scale incidents, cross-border impact, crisis coordination 70Cyber crises, coordinated response, resilience 71EU-CyCLONe, operational coordination, political decision-making 72Union-wide crisis response, civil protection, situational awareness 73International agreements, third countries, data protection 74Third-country cooperation, information exchange, cyber exercises 75Peer reviews, mutual trust, exchange of experience 76Self-assessment, national capacities, Cooperation Group 77Risk-management culture, entity responsibility, risk assessment 78Risk management, incident handling, human factors 79All-hazards approach, physical security, access control 80Cybersecurity certification, ICT products, standards 81Proportionality, state of the art, implementation costs 82Risk exposure, criticality, societal impact 83System responsibility, in-house IT, outsourced maintenance 84Digital services, Union-wide harmonisation, implementing act 85Supply chain security, suppliers, contractual arrangements 86Managed security services, provider selection, supplier risks 87Cybersecurity service providers, penetration testing, security audits 88Trade secrets, research partners, external data processing 89Cyber hygiene, zero trust, staff training 90Critical supply chains, coordinated risk assessment, dependencies 91Supply chain assessment, technical risks, non-technical factors 92Electronic communications, trust services, replacement of sectoral duties 93Trust services, eIDAS, security and reporting duties 94Trust service supervision, authority cooperation, joint notification 95Telecom supervision, existing guidance, security requirements 96Messaging services, interpersonal communications, risk-based security 97Public communications networks, submarine cables, incidents 98End-to-end encryption, privacy, communications security 99Secure routing, interoperability, internet integrity 100DNS resilience, diversified resolution, European DNS service

Recitals (101–144)

101Significant incidents, phased reporting, initial assessment 102Significant incidents, reporting deadlines, final report 103Service recipients, cyber threats, protective information 104Communications services, security by design, user information 105Voluntary threat notifications, prevention, proactive approach 106Single entry point, notification formats, administrative burden 107Cybercrime, law enforcement, coordination between authorities 108Personal data breaches, authority cooperation, information exchange 109Domain registration data, WHOIS, data quality, access 110Access to domain data, legitimate access seekers, justification 111Domain registration data, verification procedures, contact validation 112Publication of domain data, privacy, disclosure procedures 113Jurisdiction, establishment, cross-border supervision 114Main establishment, digital services, competent Member State 115Recursive DNS services, internet access, jurisdiction 116Third-country providers, representative in the Union, offering services 117ENISA registry, digital providers, registration information 118Classified information, sensitive information, confidentiality 119Information sharing, cyber threats, vulnerabilities 120Voluntary information sharing, arrangements, cooperation 121Personal data, lawful bases, security purposes 122Essential and important entities, ex ante and ex post supervision 123Supervisory measures, business operations, limiting disruption 124Risk-based supervision, prioritisation, supervisory methodologies 125Supervisory staff, expertise, objective inspections 126Urgent enforcement, significant cyber threats, immediate action 127Enforcement powers, proportionality, procedural safeguards 128Natural persons, liability, national rules 129Administrative fines, competent authorities, enforcement 130Concept of undertaking, calculation of fines, public entities 131Criminal penalties, ne bis in idem, national law 132National penalties, effectiveness, deterrence 133Suspension of authorisations, management bans, last resort 134Mutual assistance, cross-border supervision, Cooperation Group 135Mutual assistance requests, supervisory measures, cross-border enforcement 136Data protection infringements, cooperation between supervisory authorities 137Management bodies, risk management, oversight 138Delegated acts, certification requirements, consultation 139Implementing acts, technical requirements, notification procedures 140Review of the Directive, size criteria, sectors 141ENISA, additional tasks, budget resources 142Subsidiarity, proportionality, Union objective 143Fundamental rights, privacy, effective judicial remedy 144European Data Protection Supervisor, consultation, opinion

Document version

Official Journal version of 27 December 2022