The European Commission adopted on Thursday the initial implementing rules on cybersecurity of critical entities and networks under the Directive on measures for a high common level of cybersecurity across the Union. The NIS2 Directive addresses cybersecurity risk management measures and cases in which an incident should be considered significant and companies providing digital infrastructures and services should report it to national authorities. The move is seen as another major step in boosting the cyber resilience of Europe’s critical digital infrastructure.

The implementing regulation will apply to specific categories of companies providing digital services, such as cloud computing service providers, data center service providers, online marketplaces, online search engines, and social networking platforms, to name a few. For each category of service providers, the implementing act also specifies when an incident is considered significant.

Adopting the implementing regulation coincides with the deadline for Member States to transpose the NIS2 Directive into national law. As of Oct. 18, 2024, all Member States must apply the measures necessary to comply with the NIS2 cybersecurity rules, including supervisory and enforcement measures. The implementing regulation will be published in the Official Journal in due course and enter into force 20 days thereafter.