### Why NIS2 is Necessary?
The effectiveness and security of digital infrastructures are crucial for ensuring the economic and social stability of a country. Recent analyses have highlighted an exponential increase in cyber threats, accompanied by an evolution of the tactics and techniques used by cybercriminals. These attacks not only threaten individual organizations but can also have significant repercussions at an intercontinental level, affecting the systems of various member states of the European Union.
There are three main reasons that have made the adoption of NIS2, the second Directive on the Security of Network and Information Systems, urgent:
1. **Extensive Digitalization**: Critical processes in both the industrial and public sectors have been digitized, expanding the attack surface for potential attackers.
2. **Global Interdependence**: The increasing sharing of data and services means that an attack on a critical infrastructure in one country can have devastating effects beyond national borders.
3. **Unified Response**: Adopting a collective approach is crucial for strengthening the security of organizations deemed essential, making cybersecurity a fundamental strategic objective.
In Italy, the implementation of NIS2 will affect over 15,000 entities and is expected to result in an average increase of 20% in the IT budgets of the organizations involved.
### Areas of Application of NIS2
NIS2 establishes two main categories of private entities that fall within its scope, regulating them based on their criticality and strategic importance.
– **Essential Entities (Highly Critical)**: This category includes large companies with more than 250 employees and/or revenues exceeding 50 million euros or balances over 43 million euros, which operate in sectors such as energy, transport, healthcare, digital infrastructure, and information technology.
– **Important Entities (Critical)**: This includes medium-sized enterprises with more than 50 employees and revenues above 10 million euros or balances exceeding 5 million, active in areas such as postal services, waste management, food distribution, and digital services.
Public administrations are also included, particularly entities with a significant volume of operations or population, as well as research and cultural institutions.
### Characterizing Elements of NIS2
NIS2 establishes a broad set of obligations, including the registration and identification of obligated organizations, which must register independently on a portal managed by the National Cybersecurity Agency. Such registration must occur within set annual deadlines and involves the communication of sensitive information, such as IP addresses and domain names.
The National Cybersecurity Agency plays a central role in implementing NIS2, inspecting compliance and imposing corrective measures. Its responsibilities include issuing guidelines, monitoring compliance with regulations, and imposing penalties for non-compliance.
Organizations are required to ensure compliance oversight by their administrative bodies, promoting risk management measures and periodic training for their staff. It is also crucial to apply secure practices, such as multi-factor authentication and the use of encryption.
Significant security incidents must be reported within specific time frames:
1. **Pre-notification**: Within 24 hours of discovering the incident.
2. **Complete Notification**: Within 72 hours, including an initial damage assessment.
3. **Final Report**: Within one month, containing a detailed description of the incident and the measures taken.
Violations of the regulations result in substantial financial penalties, and non-compliance can have serious consequences.
