What is the essence of the NIS2 directive?
NIS2 is an extension of its preceding directive, the NIS Directive. In Finland, the NIS2 directive is implemented with the new legislation on cybersecurity. The new legislation covers a broader range of sectors classified as critical to society. These include:
- Energy, healthcare, transport, drinking- and wastewater, space, and finance sector, including their infrastructure
- Public administration, ICT-sector (security and operations services), and digital infrastructure
- Food industry, waste management, postal and courier services
- Manufacturing industry e.g., medical device and the chemical sector
- Digital services (marketplaces, search engines) and research
- Healthcare providers, EU reference laboratories, pharmaceutical research and development, and pharmaceutical manufacturers
- Manufacturers of critical medical device in potential public health emergencies.
It is important to understand that if your organisation has customers or e.g., partners who are categorized as critical by the legislation, you are very likely included in their supply chain. As a result, the legislative requirements also apply to your organisation. Typically, the legislative requirements extend at least to the primary subcontractors.
