S23 Ep2: NIS2: Decoding EU's cyber security game plan

Overview of NIST2 Legislation

NIST2 is a piece of European legislation that imposes stricter cybersecurity obligations on entities operating in critical infrastructure sectors. It complements and extends the Network and Information Security (NIST) directive introduced in 2016, expanding the coverage to more companies. It applies to organizations providing essential services like internet providers, energy suppliers, banking institutions, healthcare institutions, and food and household item factories. However, there are exceptions based on size, with small companies below certain thresholds being exempt. Non-compliance with NIST2 can result in fines of up to 10 million euros or a percentage of the company's annual global turnover. Individuals with relevant cybersecurity authority or management roles may also be held personally responsible for noncompliance.