# Network and Information Security Directive – Directive (EU) 2022/2555 URL: https://consilena.com/coverage/laws/stat_eu_32022l2555 - Jurisdiction: European Union - Type: Directive - Short name: NIS2 - Identifier: 32022L2555 - Current as of: 27 December 2022 - Provisions: 46 - Official text: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02022L2555-20221227 - Licence: [Commission Decision 2011/833/EU](https://eur-lex.europa.eu/eli/dec/2011/833/oj) - Attribution: Source: EUR-Lex, © European Union, https://eur-lex.europa.eu. Reuse authorised under Commission Decision 2011/833/EU; only the Official Journal text is authentic. > The library is a research copy. Check the official source before relying on a provision: the text published there, not the copy in Consilena, is the law. ## Provisions ### Chapter I – General provisions - **Art. 1 Subject matter**: 1. This Directive lays down measures that aim to achieve a high common level of cybersecurity across the Union, with a view to improving the functioning of the… - **Art. 2 Scope**: 1. This Directive applies to public or private entities of a type referred to in Annex I or II which qualify as medium-sized enterprises under Article 2 of the… - **Art. 3 Essential and important entities**: 1. For the purposes of this Directive, the following entities shall be considered to be essential entities: (a) entities of a type referred to in Annex I which… - **Art. 4 Sector-specific Union legal acts**: 1. Where sector-specific Union legal acts require essential or important entities to adopt cybersecurity risk-management measures or to notify significant… - **Art. 5 Minimum harmonisation**: This Directive shall not preclude Member States from adopting or maintaining provisions ensuring a higher level of cybersecurity, provided that such provisions… - **Art. 6 Definitions**: For the purposes of this Directive, the following definitions apply: (1) ‘network and information system’ means: (a) an electronic communications network as… ### Chapter II – Coordinated cybersecurity frameworks - **Art. 7 National cybersecurity strategy**: 1. Each Member State shall adopt a national cybersecurity strategy that provides for the strategic objectives, the resources required to achieve those… - **Art. 8 Competent authorities and single points of contact**: 1. Each Member State shall designate or establish one or more competent authorities responsible for cybersecurity and for the supervisory tasks referred to in… - **Art. 9 National cyber crisis management frameworks**: 1. Each Member State shall designate or establish one or more competent authorities responsible for the management of large-scale cybersecurity incidents and… - **Art. 10 Computer security incident response teams (CSIRTs)**: 1. Each Member State shall designate or establish one or more CSIRTs. The CSIRTs may be designated or established within a competent authority. The CSIRTs… - **Art. 11 Requirements, technical capabilities and tasks of CSIRTs**: 1. The CSIRTs shall comply with the following requirements: (a) the CSIRTs shall ensure a high level of availability of their communication channels by… - **Art. 12 Coordinated vulnerability disclosure and a European vulnerability database**: 1. Each Member State shall designate one of its CSIRTs as a coordinator for the purposes of coordinated vulnerability disclosure. The CSIRT designated as… - **Art. 13 Cooperation at national level**: 1. Where they are separate, the competent authorities, the single point of contact and the CSIRTs of the same Member State shall cooperate with each other with… ### Chapter III – Cooperation at union and international level - **Art. 14 Cooperation Group**: 1. In order to support and facilitate strategic cooperation and the exchange of information among Member States, as well as to strengthen trust and confidence… - **Art. 15 CSIRTs network**: 1. In order to contribute to the development of confidence and trust and to promote swift and effective operational cooperation among Member States, a network… - **Art. 16 European cyber crisis liaison organisation network (EU-CyCLONe)**: 1. EU-CyCLONe is established to support the coordinated management of large-scale cybersecurity incidents and crises at operational level and to ensure the… - **Art. 17 International cooperation**: The Union may, where appropriate, conclude international agreements, in accordance with Article 218 TFEU, with third countries or international organisations… - **Art. 18 Report on the state of cybersecurity in the Union**: 1. ENISA shall adopt, in cooperation with the Commission and the Cooperation Group, a biennial report on the state of cybersecurity in the Union and shall… - **Art. 19 Peer reviews**: 1. The Cooperation Group shall, by 17 January 2025, establish, with the assistance of the Commission and ENISA, and, where relevant, the CSIRTs network, the… ### Chapter IV – Cybersecurity risk-management measures and reporting obligations - **Art. 20 Governance**: 1. Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those… - **Art. 21 Cybersecurity risk-management measures**: and reporting obligations — Art. 21 NIS2 — Cybersecurity risk-management measures 1. Member States shall ensure that essential and important entities take… - **Art. 22 Union level coordinated security risk assessments of critical supply chains**: 1. The Cooperation Group, in cooperation with the Commission and ENISA, may carry out coordinated security risk assessments of specific critical ICT services… - **Art. 23 Reporting obligations**: 1. Each Member State shall ensure that essential and important entities notify, without undue delay, its CSIRT or, where applicable, its competent authority in… - **Art. 24 Use of European cybersecurity certification schemes**: 1. In order to demonstrate compliance with particular requirements of Article 21, Member States may require essential and important entities to use particular… - **Art. 25 Standardisation**: 1. In order to promote the convergent implementation of Article 21(1) and (2), Member States shall, without imposing or discriminating in favour of the use of… ### Chapter V – Jurisdiction and registration - **Art. 26 Jurisdiction and territoriality**: 1. Entities falling within the scope of this Directive shall be considered to fall under the jurisdiction of the Member State in which they are established… - **Art. 27 Registry of entities**: 1. ENISA shall create and maintain a registry of DNS service providers, TLD name registries, entities providing domain name registration services, cloud… - **Art. 28 Database of domain name registration data**: 1. For the purpose of contributing to the security, stability and resilience of the DNS, Member States shall require TLD name registries and entities providing… ### Chapter VI – Information sharing - **Art. 29 Cybersecurity information-sharing arrangements**: 1. Member States shall ensure that entities falling within the scope of this Directive and, where relevant, other entities not falling within the scope of this… - **Art. 30 Voluntary notification of relevant information**: 1. Member States shall ensure that, in addition to the notification obligation provided for in Article 23, notifications can be submitted to the CSIRTs or… ### Chapter VII – Supervision and enforcement - **Art. 31 General aspects concerning supervision and enforcement**: 1. Member States shall ensure that their competent authorities effectively supervise and take the measures necessary to ensure compliance with this Directive… - **Art. 32 Supervisory and enforcement measures in relation to essential entities**: 1. Member States shall ensure that the supervisory or enforcement measures imposed on essential entities in respect of the obligations laid down in this… - **Art. 33 Supervisory and enforcement measures in relation to important entities**: 1. When provided with evidence, indication or information that an important entity allegedly does not comply with this Directive, in particular Articles 21 and… - **Art. 34 General conditions for imposing administrative fines on essential and important entities**: 1. Member States shall ensure that the administrative fines imposed on essential and important entities pursuant to this Article in respect of infringements of… - **Art. 35 Infringements entailing a personal data breach**: 1. Where the competent authorities become aware in the course of supervision or enforcement that the infringement by an essential or important entity of the… - **Art. 36 Penalties**: Member States shall lay down rules on penalties applicable to infringements of national measures adopted pursuant to this Directive and shall take all measures… - **Art. 37 Mutual assistance**: 1. Where an entity provides services in more than one Member State, or provides services in one or more Member States and its network and information systems… ### Chapter VIII – Delegated and implementing acts - **Art. 38 Exercise of the delegation**: 1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article. 2. The power to adopt delegated acts… - **Art. 39 Committee procedure**: 1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011. 2. Where reference… ### Chapter IX – Final provisions - **Art. 40 Review**: By 17 October 2027 and every 36 months thereafter, the Commission shall review the functioning of this Directive, and report to the European Parliament and to… - **Art. 41 Transposition**: 1. By 17 October 2024, Member States shall adopt and publish the measures necessary to comply with this Directive. They shall immediately inform the Commission… - **Art. 42 Amendment of Regulation (EU) No 910/2014**: In Regulation (EU) No 910/2014, Article 19 is deleted with effect from 18 October 2024. - **Art. 43 Amendment of Directive (EU) 2018/1972**: In Directive (EU) 2018/1972, Articles 40 and 41 are deleted with effect from 18 October 2024. - **Art. 44 Repeal**: Directive (EU) 2016/1148 is repealed with effect from 18 October 2024. References to the repealed Directive shall be construed as references to this Directive… - **Art. 45 Entry into force**: This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. - **Art. 46 Addressees**: This Directive is addressed to the Member States. --- Consilena is a software provider, not a law firm. AI output is not legal advice: consult a licensed lawyer in the relevant jurisdiction. Page: https://consilena.com/coverage/laws/stat_eu_32022l2555. Index of every page: https://consilena.com/llms.txt.