Last June, the draft legislative decree was approved, which in turn was approved by Parliament in October 2024, which implements EU Directive 2022\/2555, known as NIS 2 (\u201cNetwork and Information Security Directive\u201d), in our country. The framework, which the European Union has conceived to address new cybersecurity challenges, requires that organizations comply starting from 17 October 2024.<\/p>\n
The Directive represents an important advancement in the European Union\u2019s cybersecurity strategy, overcoming the provisions of the previous NIS Directive. The new directive was, in fact, designed to strengthen the cybersecurity of \u201cessential\u201d and \u201cimportant\u201d entities within the Union, responding to the growing and increasingly sophisticated digital threats.<\/p>\n
In this regard, NIS2 introduces more stringent security protocols, requires increased breach reporting and establishes stronger governance frameworks, extending its application to a greater number of sectors than the previous Directive.<\/p>\n
In order to create a single and robust defence mechanism against digital threats, the Directive provides for specific measures such as the identification of critical entities, risk assessment, the adoption of appropriate security measures and collaboration between national authorities.<\/p>\n
The associated legislative decree integrates a cyber crisis management framework at national level and confirms the National Cybersecurity Agency (ACN) as the Competent National Authority. The Directive also establishes the criteria for identifying public and private entities required to comply with cybersecurity standards, classifying them into \u201cessential\u201d and \u201cimportant\u201d categories based on their economic and social relevance. These criteria outline the obligations in terms of cybersecurity risk management, helping to consolidate the resilience of the European digital single market.<\/p>\n
The main differences between the two directives highlight the intent to strengthen cybersecurity across the European Union. While NIS1 applied only to \u201coperators of essential services\u201d (OES) and \u201cdigital service providers\u201d (DSPs) in specific sectors, NIS 2 significantly expands its scope, including a much broader range of entities classified as \u201cessential\u201d and \u201cimportant\u201d across 15 different sectors, including energy, transport, banking, healthcare, digital infrastructure.<\/p>\n
NIS2 introduces more detailed and harmonized security requirements that covered entities must implement. These requirements include risk assessments, the drafting of incident response plans, and the identification of supply chain security measures. It gives national authorities the power to impose much more severe penalties for non-compliance. Fines can be up to \u20ac10 million or 2% of the company\u2019s global annual turnover. Furthermore, authorities have the power to issue binding instructions and temporarily suspend services in case of serious violations.<\/p>\n","protected":false},"excerpt":{"rendered":"
Audit, Consulting, Training.<\/p>\n","protected":false},"author":2,"featured_media":13614,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[78],"tags":[160,161,162,163,164,165],"class_list":["post-13623","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-en","tag-audit-nis-2-en","tag-consulenza-nis-2-en","tag-cybersicurezza-en","tag-direttiva-ue-2022-2555-en","tag-formazione-nis-2-en","tag-nis-2-en","category-78","description-off"],"yoast_head":"\n