Monday

16th May 2022

EU reaches deal on flagship cybersecurity law

  • Parliaments, the judiciary and central banks, as well as the fields of public security, defence and law enforcement, are excluded from the new rules (Photo: Tirza van Dijk)
Listen to article

The European Parliament and EU member states reached an agreement in the early hours on Friday (13 May) over new rules intended to protect Europe's public and private critical entities from cyberattacks.

The updated legislation, also known as NIS2, aims to increase cooperation and cybersecurity resilience among member states by establishing new measures and reporting obligations for operators of essential services like banking and energy.

Read and decide

Join EUobserver today

Become an expert on Europe

Get instant access to all articles — and 20 years of archives. 14-day free trial.

... or subscribe as a group

"We are shielding our economies and our societies against cyber threats. Enhancing preparedness, resilience, protecting our democracy," said EU commission vice-president Margaritas Schinas after the deal was reached.

Under the previous rules, EU countries could choose which entities fell into the category of "critical" or "essential" services.

But the update of the Network and Information Security Directive (NIS2) introduces common rules for medium and large bodies operating within critical sectors, such as energy, transport, health and digital infrastructure.

These include providers of telecom services and energy supplies, rail infrastructure managers, financial services, waste and water management operators, postal and courier services, medical device manufacturers, and public administrations.

But parliaments, the judiciary and central banks, as well as entities in the areas of public security, defence and law enforcement, are excluded from the scope.

"This … is going to help more than a 100,000 vital entities to tighten their grip on security and make Europe a safe place to live and work," said lead Dutch liberal MEP Bart Groothuis.

Companies and public operators will have to analyse cybersecurity risks and put in place measures to prevent potential cyberattacks, such as basic computer hygiene, encryption, or multi-factor authentication.

They will also have to report any potential cyberattacks and remedies that they have taken in response to such incidents — facing sanctions if found in breach of the rules.

The EU agency for cybersecurity (ENISA) has been carrying out testing exercises since last year to prepare a fast European response when facing cross-border cyberattacks.

But the NIS2 will establish the European Cyber Crises Liaison Organisation Network (EU-CyCLONe) to support and coordinate crisis management of large-scale cyberattacks in the 27-nations bloc.

The updated legislation also introduces a voluntary "peer-learning mechanism" carried out by designated experts in a bid to increase mutual trust and exchange good practices and information among EU member states.

Nevertheless, all EU countries will have to carry out a self-assessment regarding technical capabilities and financial resources prior to the peer-reviewing — as requested by MEPs during the negotiations.

Once formally adopted, member states will have nearly two years to transpose it into national law.

Feature

Nordic parliaments agree mutual defence on cyberattacks

A cyberattack against one of the Nordic parliaments will be seen as an attack on them all, MPs at the annual council of Denmark, Finland, Iceland, Norway, Sweden, the Faroe Islands, Greenland and Åland agreed this week.

EU Commission won't probe 'Pegasus' spyware abuse

The European Commission says people should file their complaints with national authorities in countries whose governments are suspected of using an Israeli-made Pegasus spyware against them.

Stakeholder

The CPDP conference wants multidisciplinary digital future

During the Computers, Privacy and Data Protection (CPDP) conference, many high-level discussions will touch upon the dynamics of decision-making in the design of new technologies, including the importance of inclusion, diversity, and ethics perspectives within these processes.

EU Commission won't probe 'Pegasus' spyware abuse

The European Commission says people should file their complaints with national authorities in countries whose governments are suspected of using an Israeli-made Pegasus spyware against them.

News in Brief

  1. McDonald's to sell up and exit Russia
  2. Nordic nations to help Sweden and Finland if attacked
  3. Germany to reject EU green label for nuclear
  4. Afghans and Syrians using Western Balkans to enter EU
  5. Putin: Russia will respond if Nato bolsters Sweden and Finland
  6. British PM urges Northern Irish parties to work together
  7. EU-US pledge to counter Russian propaganda in Ukraine
  8. EU greenhouse-gas emissions rebound to pre-pandemic levels 

Stakeholders' Highlights

  1. Nordic Council of MinistersClear to proceed - green shipping corridors in the Nordic Region
  2. Nordic Council of MinistersNordic ministers agree on international climate commitments
  3. UNESDA - SOFT DRINKS EUROPEEfficient waste collection schemes, closed-loop recycling and access to recycled content are crucial to transition to a circular economy in Europe
  4. UiPathNo digital future for the EU without Intelligent Automation? Online briefing Link
  5. Nordic Council of MinistersHuge support for Ukraine
  6. EFBWW – EFBH – FETBBWorkers want EC to limit subcontracting chains in construction

Latest News

  1. EU countries rush to expand gas import capacity
  2. MEPs call to speed up curbs on toxic 'forever chemicals'
  3. Russia's war stifles EU pandemic recovery
  4. Sweden and Finland Nato decision is right for Baltic
  5. Sweden to join Finland in applying for Nato
  6. Russia sanctions and energy dominate Next WEEK
  7. Will 'Putin's Nato' follow Warsaw Pact into obscurity?
  8. EU reaches deal on flagship cybersecurity law

Join EUobserver

Support quality EU news

Join us