Cybersecurity in the EU: How the NIS2-directive stacks up against its predecessor

Abstract

In December 2022 the second Directive on security of network and information systems (NIS2 Directive) was published. The first directive, adopted in 2016, aimed to provide a high common level of cybersecurity across the Member States, but proved difficult to implement. To respond to new threats posed by digitalisation and the overall surge in cyber-attacks, it was decided to overhaul this framework to strengthen security requirements, address supply chain security, streamline reporting, and introduce stricter supervisory measures and enforcement. In this paper, we will analyse the core tenets of the NIS2 Directive and conduct a comparison with how these new requirements stack up against the NIS Directive. We will also frame this initiative in the EU's overall cybersecurity initiatives.