NIS2

What it means

NIS2 is the EU cybersecurity directive that widened the circle of regulated entities. Slovakia transposed it into the cybersecurity act and its implementing decrees.

It is not only energy and healthcare: digital service providers, manufacturing, transport, waste management and postal services above a certain size are in scope.

NIS2 and GDPR overlap but protect different things. GDPR concerns personal data and the rights of the people a company holds data about. NIS2 protects the availability and security of the services and systems themselves, even where they hold no personal data. A single incident, such as ransomware in the accounting system, can trigger notifications under both regimes at once, each to a different authority.

How it works in practice

The duties are concrete: risk management, backups and a recovery plan, access management, supply chain security and incident reporting within tight deadlines.

For a smaller company supplying a regulated entity it shows up as contract requirements: evidence your measures, allow an audit, report incidents to the customer. Regulation spreads down the chain.

The first step is to find out whether the company is in scope at all: the sector and size by headcount and turnover decide, in a group often with linked companies counted in. We supply the client with the figures from payroll and the books, and advise filing the outcome of the assessment in the compliance records even if it shows no obligations apply.

What to watch out for

Management answers for compliance, not the IT department. The law expressly attaches responsibility to company officers, so handing the topic to an external network administrator is not enough.

Insurers writing cyber insurance increasingly check whether the company had the measures the law requires. If after an incident it turns out that two-factor authentication or working backups were missing, the payout may be reduced or refused and the company bears the loss itself.