The NIS2 Directive (Directive (EU) 2022/2555) is the European Union’s legal framework for a high common level of cybersecurity. It replaced the original NIS Directive, widened the range of sectors covered and introduced stricter duties and supervision. As a directive, it is applied through national laws in each Member State.

Key elements

• Scope: medium and large organizations in critical sectors such as energy, transport, banking, health, digital infrastructure, public administration and many manufacturing and digital services, classed as essential or important entities.
• Risk management: entities must take appropriate technical, operational and organizational measures, including incident handling, supply chain security, vulnerability handling, access control and encryption.
• Incident reporting: significant incidents must be reported to the national CSIRT or authority in several stages, starting with an early warning.
• Accountability: management bodies must approve and oversee the measures and can be held liable. Supervisors can impose fines.

Why it matters for dark web monitoring

NIS2 asks organizations to understand their threats, manage supply chain risk and detect incidents quickly. Leaked credentials, stolen data offered for sale and access brokers naming a company are early signs of an incident that may later need to be reported. External threat monitoring therefore supports both the risk management and the incident detection duties of the directive.

Sources: European Commission: NIS2 Directive, EUR-Lex: Directive (EU) 2022/2555 (NIS2)