Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive) (Text with EEA relevance)
Corrected by
  • Corrigendum to Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive), 32022L2555R(04), December 22, 2023
Directive (EU) 2022/2555 of the European Parliament and of the Councilof 14 December 2022on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)(Text with EEA relevance) CHAPTER IGENERAL PROVISIONS
Article 1Subject matter1.This Directive lays down measures that aim to achieve a high common level of cybersecurity across the Union, with a view to improving the functioning of the internal market.2.To that end, this Directive lays down:(a)obligations that require Member States to adopt national cybersecurity strategies and to designate or establish competent authorities, cyber crisis management authorities, single points of contact on cybersecurity (single points of contact) and computer security incident response teams (CSIRTs);(b)cybersecurity risk-management measures and reporting obligations for entities of a type referred to in Annex I or II as well as for entities identified as critical entities under Directive (EU) 2022/2557;(c)rules and obligations on cybersecurity information sharing;(d)supervisory and enforcement obligations on Member States.
Article 2Scope1.This Directive applies to public or private entities of a type referred to in Annex I or II which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC, or exceed the ceilings for medium-sized enterprises provided for in paragraph 1 of that Article, and which provide their services or carry out their activities within the Union.Article 3(4) of the Annex to that Recommendation shall not apply for the purposes of this Directive.2.Regardless of their size, this Directive also applies to entities of a type referred to in Annex I or II, where:(a)services are provided by:(i)providers of public electronic communications networks or of publicly available electronic communications services;(ii)trust service providers;(iii)top-level domain name registries and domain name system service providers;(b)the entity is the sole provider in a Member State of a service which is essential for the maintenance of critical societal or economic activities;(c)disruption of the service provided by the entity could have a significant impact on public safety, public security or public health;(d)disruption of the service provided by the entity could induce a significant systemic risk, in particular for sectors where such disruption could have a cross-border impact;(e)the entity is critical because of its specific importance at national or regional level for the particular sector or type of service, or for other interdependent sectors in the Member State;(f)the entity is a public administration entity:(i)of central government as defined by a Member State in accordance with national law; or(ii)at regional level as defined by a Member State in accordance with national law that, following a risk-based assessment, provides services the disruption of which could have a significant impact on critical societal or economic activities.3.Regardless of their size, this Directive applies to entities identified as critical entities under Directive (EU) 2022/2557.4.Regardless of their size, this Directive applies to entities providing domain name registration services.5.Member States may provide for this Directive to apply to:(a)public administration entities at local level;(b)education institutions, in particular where they carry out critical research activities.6.This Directive is without prejudice to the Member States’ responsibility for safeguarding national security and their power to safeguard other essential State functions, including ensuring the territorial integrity of the State and maintaining law and order.7.This Directive does not apply to public administration entities that carry out their activities in the areas of national security, public security, defence or law enforcement, including the prevention, investigation, detection and prosecution of criminal offences.8.Member States may exempt specific entities which carry out activities in the areas of national security, public security, defence or law enforcement, including the prevention, investigation, detection and prosecution of criminal offences, or which provide services exclusively to the public administration entities referred to in paragraph 7 of this Article, from the obligations laid down in Article 21 or 23 with regard to those activities or services. In such cases, the supervisory and enforcement measures referred to in Chapter VII shall not apply in relation to those specific activities or services. Where the entities carry out activities or provide services exclusively of the type referred to in this paragraph, Member States may decide also to exempt those entities from the obligations laid down in Articles 3 and 27.9.Paragraphs 7 and 8 shall not apply where an entity acts as a trust service provider.10.This Directive does not apply to entities which Member States have exempted from the scope of Regulation (EU) 2022/2554 in accordance with Article 2(4) of that Regulation.11.The obligations laid down in this Directive shall not entail the supply of information the disclosure of which would be contrary to the essential interests of Member States’ national security, public security or defence.12.This Directive applies without prejudice to Regulation (EU) 2016/679, Directive 2002/58/EC, Directives 2011/93/EUDirective 2011/93/EU of the European Parliament and of the Council of 13 December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography, and replacing Council Framework Decision 2004/68/JHA (OJ L 335, 17.12.2011, p. 1). and 2013/40/EUDirective 2013/40/EU of the European Parliament and of the Council of 12 August 2013 on attacks against information systems and replacing Council Framework Decision 2005/222/JHA (OJ L 218, 14.8.2013, p. 8). of the European Parliament and of the Council and Directive (EU) 2022/2557.13.Without prejudice to Article 346 TFEU, information that is confidential pursuant to Union or national rules, such as rules on business confidentiality, shall be exchanged with the Commission and other relevant authorities in accordance with this Directive only where that exchange is necessary for the application of this Directive. The information exchanged shall be limited to that which is relevant and proportionate to the purpose of that exchange. The exchange of information shall preserve the confidentiality of that information and protect the security and commercial interests of entities concerned.14.Entities, the competent authorities, the single points of contact and the CSIRTs shall process personal data to the extent necessary for the purposes of this Directive and in accordance with Regulation (EU) 2016/679, in particular such processing shall rely on Article 6 thereof.The processing of personal data pursuant to this Directive by providers of public electronic communications networks or providers of publicly available electronic communications services shall be carried out in accordance with Union data protection law and Union privacy law, in particular Directive 2002/58/EC.
Article 3Essential and important entities1.For the purposes of this Directive, the following entities shall be considered to be essential entities:(a)entities of a type referred to in Annex I which exceed the ceilings for medium-sized enterprises provided for in Article 2(1) of the Annex to Recommendation 2003/361/EC;(b)qualified trust service providers and top-level domain name registries as well as DNS service providers, regardless of their size;(c)providers of public electronic communications networks or of publicly available electronic communications services which qualify as medium-sized enterprises under Article 2 of the Annex to Recommendation 2003/361/EC;(d)public administration entities referred to in Article 2(2), point (f)(i);(e)any other entities of a type referred to in Annex I or II that are identified by a Member State as essential entities pursuant to Article 2(2), points (b) to (e);(f)entities identified as critical entities under Directive (EU) 2022/2557, referred to in Article 2(3) of this Directive;(g)if the Member State so provides, entities which that Member State identified before 16 January 2023 as operators of essential services in accordance with Directive (EU) 2016/1148 or national law.2.For the purposes of this Directive, entities of a type referred to in Annex I or II which do not qualify as essential entities pursuant to paragraph 1 of this Article shall be considered to be important entities. This includes entities identified by Member States as important entities pursuant to Article 2(2), points (b) to (e).3.By 17 April 2025, Member States shall establish a list of essential and important entities as well as entities providing domain name registration services. Member States shall review and, where appropriate, update that list on a regular basis and at least every two years thereafter.4.For the purpose of establishing the list referred to in paragraph 3, Member States shall require the entities referred to in that paragraph to submit at least the following information to the competent authorities:(a)the name of the entity;(b)the address and up-to-date contact details, including email addresses, IP ranges and telephone numbers;(c)where applicable, the relevant sector and subsector referred to in Annex I or II; and(d)where applicable, a list of the Member States where they provide services falling within the scope of this Directive.The entities referred to in paragraph 3 shall notify any changes to the details submitted pursuant to the first subparagraph of this paragraph without delay, and, in any event, within two weeks of the date of the change.The Commission, with the assistance of the European Union Agency for Cybersecurity (ENISA), shall without undue delay provide guidelines and templates regarding the obligations laid down in this paragraph.Member States may establish national mechanisms for entities to register themselves.5.By 17 April 2025 and every two years thereafter, the competent authorities shall notify:(a)the Commission and the Cooperation Group of the number of essential and important entities listed pursuant to paragraph 3 for each sector and subsector referred to in Annex I or II; and(b)the Commission of relevant information about the number of essential and important entities identified pursuant to Article 2(2), points (b) to (e), the sector and subsector referred to in Annex I or II to which they belong, the type of service that they provide, and the provision, from among those laid down in Article 2(2), points (b) to (e), pursuant to which they were identified.6.Until 17 April 2025 and upon request of the Commission, Member States may notify the Commission of the names of the essential and important entities referred to in paragraph 5, point (b).
Article 4Sector-specific Union legal acts1.Where sector-specific Union legal acts require essential or important entities to adopt cybersecurity risk-management measures or to notify significant incidents and where those requirements are at least equivalent in effect to the obligations laid down in this Directive, the relevant provisions of this Directive, including the provisions on supervision and enforcement laid down in Chapter VII, shall not apply to such entities. Where sector-specific Union legal acts do not cover all entities in a specific sector falling within the scope of this Directive, the relevant provisions of this Directive shall continue to apply to the entities not covered by those sector-specific Union legal acts.2.The requirements referred to in paragraph 1 of this Article shall be considered to be equivalent in effect to the obligations laid down in this Directive where:(a)cybersecurity risk-management measures are at least equivalent in effect to those laid down in Article 21(1) and (2); or(b)the sector-specific Union legal act provides for immediate access, where appropriate automatic and direct, to the incident notifications by the CSIRTs, the competent authorities or the single points of contact under this Directive and where requirements to notify significant incidents are at least equivalent in effect to those laid down in Article 23(1) to (6) of this Directive.3.The Commission shall, by 17 July 2023, provide guidelines clarifying the application of paragraphs 1 and 2. The Commission shall review those guidelines on a regular basis. When preparing those guidelines, the Commission shall take into account any observations of the Cooperation Group and ENISA.
Article 5Minimum harmonisationThis Directive shall not preclude Member States from adopting or maintaining provisions ensuring a higher level of cybersecurity, provided that such provisions are consistent with Member States’ obligations laid down in Union law.
Article 6DefinitionsFor the purposes of this Directive, the following definitions apply:(1)"network and information system" means:(a)an electronic communications network as defined in Article 2, point (1), of Directive (EU) 2018/1972;(b)any device or group of interconnected or related devices, one or more of which, pursuant to a programme, carry out automatic processing of digital data; or(c)digital data stored, processed, retrieved or transmitted by elements covered under points (a) and (b) for the purposes of their operation, use, protection and maintenance;(2)"security of network and information systems" means the ability of network and information systems to resist, at a given level of confidence, any event that may compromise the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, those network and information systems;(3)"cybersecurity" means cybersecurity as defined in Article 2, point (1), of Regulation (EU) 2019/881;(4)"national cybersecurity strategy " means a coherent framework of a Member State providing strategic objectives and priorities in the area of cybersecurity and the governance to achieve them in that Member State;(5)"near miss" means an event that could have compromised the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, network and information systems, but that was successfully prevented from materialising or that did not materialise;(6)"incident" means an event compromising the availability, authenticity, integrity or confidentiality of stored, transmitted or processed data or of the services offered by, or accessible via, network and information systems;(7)"large-scale cybersecurity incident" means an incident which causes a level of disruption that exceeds a Member State’s capacity to respond to it or which has a significant impact on at least two Member States;(8)"incident handling" means any actions and procedures aiming to prevent, detect, analyse, and contain or to respond to and recover from an incident;(9)"risk" means the potential for loss or disruption caused by an incident and is to be expressed as a combination of the magnitude of such loss or disruption and the likelihood of occurrence of the incident;(10)"cyber threat" means a cyber threat as defined in Article 2, point (8), of Regulation (EU) 2019/881;(11)"significant cyber threat" means a cyber threat which, based on its technical characteristics, can be assumed to have the potential to have a severe impact on the network and information systems of an entity or the users of the entity’s services by causing considerable material or non-material damage;(12)"ICT product" means an ICT product as defined in Article 2, point (12), of Regulation (EU) 2019/881;(13)"ICT service" means an ICT service as defined in Article 2, point (13), of Regulation (EU) 2019/881;(14)"ICT process" means an ICT process as defined in Article 2, point (14), of Regulation (EU) 2019/881;(15)"vulnerability" means a weakness, susceptibility or flaw of ICT products or ICT services that can be exploited by a cyber threat;(16)"standard" means a standard as defined in Article 2, point (1), of Regulation (EU) No 1025/2012 of the European Parliament and of the CouncilRegulation (EU) No 1025/2012 of the European Parliament and of the Council of 25 October 2012 on European standardisation, amending Council Directives 89/686/EEC and 93/15/EEC and Directives 94/9/EC, 94/25/EC, 95/16/EC, 97/23/EC, 98/34/EC, 2004/22/EC, 2007/23/EC, 2009/23/EC and 2009/105/EC of the European Parliament and of the Council and repealing Council decision 87/95/EEC and Decision No 1673/2006/EC of the European Parliament and of the Council (OJ L 316, 14.11.2012, p. 12).;(17)"technical specification" means a technical specification as defined in Article 2, point (4), of Regulation (EU) No 1025/2012;(18)"internet exchange point" means a network facility which enables the interconnection of more than two independent networks (autonomous systems), primarily for the purpose of facilitating the exchange of internet traffic, which provides interconnection only for autonomous systems and which neither requires the internet traffic passing between any pair of participating autonomous systems to pass through any third autonomous system nor alters or otherwise interferes with such traffic;(19)"domain name system" or "DNS" means a hierarchical distributed naming system which enables the identification of internet services and resources, allowing end-user devices to use internet routing and connectivity services to reach those services and resources;(20)"DNS service provider" means an entity that provides:(a)publicly available recursive domain name resolution services for internet end-users; or(b)authoritative domain name resolution services for third-party use, with the exception of root name servers;(21)"top-level domain name registry" or "TLD name registry" means an entity which has been delegated a specific TLD and is responsible for administering the TLD including the registration of domain names under the TLD and the technical operation of the TLD, including the operation of its name servers, the maintenance of its databases and the distribution of TLD zone files across name servers, irrespective of whether any of those operations are carried out by the entity itself or are outsourced, but excluding situations where TLD names are used by a registry only for its own use;(22)"entity providing domain name registration services" means a registrar or an agent acting on behalf of registrars, such as a privacy or proxy registration service provider or reseller;(23)"digital service" means a service as defined in Article 1(1), point (b), of Directive (EU) 2015/1535 of the European Parliament and of the CouncilDirective (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015 laying down a procedure for the provision of information in the field of technical regulations and of rules on Information Society services (OJ L 241, 17.9.2015, p. 1).;(24)"trust service" means a trust service as defined in Article 3, point (16), of Regulation (EU) No 910/2014;(25)"trust service provider" means a trust service provider as defined in Article 3, point (19), of Regulation (EU) No 910/2014;(26)"qualified trust service" means a qualified trust service as defined in Article 3, point (17), of Regulation (EU) No 910/2014;(27)"qualified trust service provider" means a qualified trust service provider as defined in Article 3, point (20), of Regulation (EU) No 910/2014;(28)"online marketplace" means an online marketplace as defined in Article 2, point (n), of Directive 2005/29/EC of the European Parliament and of the CouncilDirective 2005/29/EC of the European Parliament and of the Council of 11 May 2005 concerning unfair business-to-consumer commercial practices in the internal market and amending Council Directive 84/450/EEC, Directives 97/7/EC, 98/27/EC and 2002/65/EC of the European Parliament and of the Council and Regulation (EC) No 2006/2004 of the European Parliament and of the Council ("Unfair Commercial Practices Directive") (OJ L 149, 11.6.2005, p. 22).;(29)"online search engine" means an online search engine as defined in Article 2, point (5), of Regulation (EU) 2019/1150 of the European Parliament and of the CouncilRegulation (EU) 2019/1150 of the European Parliament and of the Council of 20 June 2019 on promoting fairness and transparency for business users of online intermediation services (OJ L 186, 11.7.2019, p. 57).;(30)"cloud computing service" means a digital service that enables on-demand administration and broad remote access to a scalable and elastic pool of shareable computing resources, including where such resources are distributed across several locations;(31)"data centre service" means a service that encompasses structures, or groups of structures, dedicated to the centralised accommodation, interconnection and operation of IT and network equipment providing data storage, processing and transport services together with all the facilities and infrastructures for power distribution and environmental control;(32)"content delivery network" means a network of geographically distributed servers for the purpose of ensuring high availability, accessibility or fast delivery of digital content and services to internet users on behalf of content and service providers;(33)"social networking services platform" means a platform that enables end-users to connect, share, discover and communicate with each other across multiple devices, in particular via chats, posts, videos and recommendations;(34)"representative" means a natural or legal person established in the Union explicitly designated to act on behalf of a DNS service provider, a TLD name registry, an entity providing domain name registration services, a cloud computing service provider, a data centre service provider, a content delivery network provider, a managed service provider, a managed security service provider, or a provider of an online marketplace, of an online search engine or of a social networking services platform that is not established in the Union, which may be addressed by a competent authority or a CSIRT in the place of the entity itself with regard to the obligations of that entity under this Directive;(35)"public administration entity" means an entity recognised as such in a Member State in accordance with national law, not including the judiciary, parliaments or central banks, which complies with the following criteria:(a)it is established for the purpose of meeting needs in the general interest and does not have an industrial or commercial character;(b)it has legal personality or is entitled by law to act on behalf of another entity with legal personality;(c)it is financed, for the most part, by the State, regional authorities or by other bodies governed by public law, is subject to management supervision by those authorities or bodies, or has an administrative, managerial or supervisory board, more than half of whose members are appointed by the State, regional authorities or by other bodies governed by public law;(d)it has the power to address to natural or legal persons administrative or regulatory decisions affecting their rights in the cross-border movement of persons, goods, services or capital;(36)"public electronic communications network" means a public electronic communications network as defined in Article 2, point (8), of Directive (EU) 2018/1972;(37)"electronic communications service" means an electronic communications service as defined in Article 2, point (4), of Directive (EU) 2018/1972;(38)"entity" means a natural or legal person created and recognised as such under the national law of its place of establishment, which may, acting under its own name, exercise rights and be subject to obligations;(39)"managed service provider" means an entity that provides services related to the installation, management, operation or maintenance of ICT products, networks, infrastructure, applications or any other network and information systems, via assistance or active administration carried out either on customers’ premises or remotely;(40)"managed security service provider" means a managed service provider that carries out or provides assistance for activities relating to cybersecurity risk management;(41)"research organisation" means an entity which has as its primary goal to conduct applied research or experimental development with a view to exploiting the results of that research for commercial purposes, but which does not include educational institutions.
Loading ...