Amid concerns about cyber attacks by state actors and other malicious players, EU nations and lawmakers on Friday agreed to tougher cyber-security regulations for major energy, transportation, and financial institutions, digital providers, and medical device manufacturers.
The European Commission two years ago proposed rules on the cyber security of networks and information systems known as the NIS 2 directive and as a result, expanded the scope of the current rule known as the NIS Directive.
The new regulations apply to all medium and large companies in key sectors such as energy, transportation, banking, financial market infrastructure, health, vaccines and medical devices, drinking water, sewage, digital infrastructure, public administration, and space.
Contracts with all medium and large-scale companies in postal and courier services, waste management, chemicals, food preparation, medical equipment, computers and electronics, machine tools, motor vehicles and online marketplaces, online search engines, and digital providers. Social networking service platforms.
Companies must assess their cyber-security risk, report it to authorities, and take technical and organizational measures to reduce the risk, resulting in fines of up to 2% of global turnover.
EU countries and the EU cyber-security agency ENISA can also assess the risks of critical supply chains according to regulations.
“Cyber threats have become bolder and more complex. It is imperative that we adapt our security framework to the new realities and ensure that our citizens and infrastructure are protected, ”EU Industry Chief Theory Breton said in a statement.
