NIS2 – The EU’s New Cybersecurity Directive Impacting the Entire Supply Chain

What is NIS2?

NIS2 is an evolution of the original NIS Directive and came into force in January 2023. It requires organizations within critical infrastructure and essential societal functions to:

• Implement technical and organizational security measures.
• Report incidents within defined timeframes.
• Maintain control over their supply chain and manage third-party risks.

Who is affected?

The number of sectors has expanded from 7 to 15, including: energy, transport, banking, healthcare, water supply, digital infrastructure, and more.

Organizations are classified as:

• Essential entities – subject to stricter requirements.
• Important entities – subject to slightly less stringent requirements.

Subcontractors are also indirectly affected, as they must meet the security requirements imposed by larger entities.

Requirements and Obligations

Organizations must:

• Conduct risk management and ensure system security.
• Report incidents to authorities.
• Comply with harmonized sanctions in case of violations.

Timeline in Sweden

• Directive entered into force in the EU: January 2023.
• Deadline for national legislation: October 2024.
• In Sweden: the proposed law (SOU 2024:18) is expected to take effect on January 15, 2026.

Despite the delay, it is crucial to start preparing now. The proposed Cybersecurity Act will replace the current Information Security Act and bring significant changes.

Benefits of NIS2

• Higher level of security across the EU.
• Faster incident response through clear reporting requirements.
• Reduced fragmentation via unified sanctions.
• Increased cyber resilience throughout the supply chain.

NIS2 creates a cascading effect where cybersecurity requirements spread throughout the ecosystem – driving demand for robust security solutions and strategic risk management.

What Does NIS2 Mean for Your Organization?

• Proactive risk management: Acting before the law takes effect helps avoid costly adjustments and incidents later.
• Strengthened supplier relationships: Demonstrate that you are a secure and reliable partner in an increasingly regulated supply chain.
• Improved internal structure: Adapting to NIS2 promotes clearer roles, responsibilities, and processes in cybersecurity.
• Business resilience: Staying ahead in compliance reduces uncertainty and strengthens your organization’s defense against external threats.