Understanding and Meeting the Cybersecurity Requirements of the NIS2 Directive and IT Security Act 2.0
Summary: The EU's NIS2 Directive, released at the start of 2023, replaces the 2016 NIS Directive and identifies Operators of Essential Services by size rather than leaving that choice to member states, with non-compliance risking fines up to €10 million or 2 percent of global annual turnover. Germany's IT-Sicherheitsgesetz 2.0, adopted by the Bundesrat on 7 May 2021, places security obligations on critical infrastructure operators with fines reaching €2 million, and is being updated in May 2023 to add mandatory controls on detecting cyber attacks.
What's compelling: Many organisations in Germany will be classified as an Operator of Essential Service for the first time, and the two regimes stack fines of up to €10 million or 2 percent of global turnover alongside €2 million, while OT connected to IT networks gives criminals and state-backed actors a path to industrial processes.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026