NIS2-krav til virksomheder

NIS2 is an EU directive designed to strengthen cybersecurity and resilience in sectors vital to society and critical infrastructure. In Denmark, the directive has been implemented through the NIS2 Act, which sets requirements for, among other things, risk management, security measures, incident reporting, supplier management, management responsibility, and documentation.

NIS2 may cover both private and public organizations. Whether an organization is covered depends, among other things, on its sector, size, and the specific role it plays in the supply chain. Relevant sectors include, among others, energy, transportation, healthcare, drinking water, digital infrastructure, IT services, public administration, food, waste management, and manufacturing.

Nesp.ONE helps determine whether an organization is subject to NIS2, which requirements apply, and how these requirements can be translated into specific security measures, documentation, and ongoing monitoring.

Read more about NIS2 here: EUR.lex, Samsik.dk, Europa.eu,Retsinformation.dk

NIS2 requires that covered organizations adopt a risk-based approach using appropriate technical, organizational, and operational security measures. This means that security measures must be based on the organization’s specific risks, systems, suppliers, and critical services.

The requirements include, among other things, incident management, emergency preparedness and business continuity, supplier management, access control, asset management, encryption where applicable, awareness, cyber hygiene, and documentation. The purpose is not only to protect data, but also to reduce the risk of operational disruptions, service interruptions, and incidents that could affect customers, citizens, business partners, or critical societal functions.

Nesp.ONE helps identify relevant requirements, prioritize necessary actions, and establish a structured approach that supports both compliance and a higher level of security.

A risk-based approach means that the organization must prioritize its security efforts based on where the consequences of an incident would be greatest (Learn more about the risk-based approach here). This requires a comprehensive overview of systems, data, processes, suppliers, dependencies, and the services the organization must be able to deliver.

This also means that not all security measures need to be implemented in the same way everywhere. Critical systems, business-critical processes, and key suppliers may require a higher level of security than less critical areas. A risk-based approach makes it possible to allocate resources in a more targeted manner and to document why certain measures are prioritized.

Nesp.ONE assists with risk assessment, gap analysis, and action plans, providing the organization with a concrete foundation for working toward NIS2 compliance.

NIS2 places senior management at the center of cybersecurity efforts. Senior management must be able to approve, monitor, and ensure the implementation of relevant cybersecurity measures. This does not require detailed technical knowledge, but rather a clear basis for decision-making regarding risks, responsibilities, priorities, and necessary actions.

For the organization, this means that cybersecurity must be treated as part of its overall risk management. Management must be able to document that it takes a structured approach to security, emergency preparedness, supplier management, and incident response.

Nesp.ONE helps make management responsibilities concrete through risk profiles, prioritized action plans, reporting, and documentation that can be used by management, the board of directors, and supervisory bodies.

NIS2 requires that significant security incidents be reported within specified timeframes. As a general rule, an initial notification must be submitted within 24 hours, an incident report within 72 hours, and a final report no later than one month after the incident report (Read more about the incident reporting requirements here).

This requires clear procedures for detecting, assessing, escalating, and documenting incidents. The organization must be able to assess the severity of the incident, collect relevant information, and ensure timely reporting to the appropriate authorities.

Nesp.ONE helps establish IT contingency plans, reporting procedures, and action cards so that the organization can respond quickly, minimize the impact, and document incident management.

NIS2 requires that covered organizations actively address supply chain security. This means that the organization must assess relevant suppliers, set appropriate security requirements, and monitor compliance with those requirements.

Supplier management includes, among other things, risk assessment, contractual requirements, access to systems and data, subcontractors, contingency planning, and documentation of security measures. For suppliers, NIS2 also means that they may face stricter requirements from customers covered by NIS2, even if they themselves are not necessarily directly covered.

Nesp.ONE helps provide an overview of supplier risks, define relevant security requirements, and establish a practical process for follow-up and documentation.

Failure to comply with NIS2 may result in oversight, injunctions, and significant penalties. For substantial entities, fines can amount to up to 10 million euros or 2 percent of global annual revenue. For important entities, fines can amount to up to 7 million euros or 1.4 percent of global annual revenue, whichever is higher.

However, the overall risk extends beyond sanctions. A lack of control over cybersecurity can also lead to operational disruptions, delayed deliveries, data loss, increased costs, contractual consequences, and a loss of trust among customers, citizens, and business partners.

Nesp.ONE helps establish a structured and documented approach to NIS2, enabling the organization to reduce the risk of both regulatory and operational consequences.