NIS2 Compliance with Dragos
Summary: The NIS2 Directive is EU-wide cybersecurity legislation that member states had to transpose into national law by October 17, 2024, with compliance required from October 18, 2024, covering Essential Entities such as energy, transportation, banking, healthcare and water utilities and Important Entities such as digital providers, postal services, waste management, food, chemicals and manufacturing. It requires significant incidents to be reported to national authorities within 24 hours of detection and a final report within 30 days, with penalties of up to €10 million or 2% of total worldwide annual turnover, whichever is higher, and possible personal liability for senior management of Essential Entities.
Bottom line: Penalties reach €10 million or 2% of worldwide annual turnover, and senior management of Essential Entities can be held personally liable for failing to meet compliance. Non-EU organisations providing critical services within the EU, or supplying EU-based critical infrastructure providers, fall under the same requirements.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026