NIS2 and the Cyber Resilience Act: IT security duties in the EU

In short: NIS2 obliges many companies to risk management and reporting of cyber incidents; the Cyber Resilience Act requires security of products with digital elements.

In more detail: The EU is tightening its cybersecurity rules. Two big projects affect businesses and manufacturers: the NIS 2 Directive (network and information security) and the Cyber Resilience Act (CRA). Implementation in Germany and the deadlines are evolving, check the current status. This is general information and not legal advice; laws change and individual cases can differ. For concrete problems counselling (consumer advice, lawyer, data protection authority) helps.

In Depth

NIS2: Who is affected?

Affected are essential and important entities in many sectors (energy, transport, health, water, digital infrastructure, IT service providers, postal services, waste, food, industry, chemicals and others), usually from a size of about 50 employees or 10 million euros turnover; some providers (for example DNS, data centres) regardless of size. Suppliers can be indirectly affected (supply chain).

NIS2: What is required?

• Risk-management measures: risk analysis, security concepts, incident handling, business continuity/backup, supply-chain security, vulnerability management, cryptography, access control, multi-factor authentication, training.
• Reporting duties: early warning within 24 hours, notification after 72 hours, final report after one month.
• Management responsibility (approval, training, personal liability).
• Registration with the authority (BSI) and sanctions (fines up to millions).

Cyber Resilience Act (CRA)

The CRA applies to products with digital elements (hardware and software that is networked: smart-home devices, routers, apps, IoT, commercially distributed software libraries). Manufacturers must develop securely (security by design), manage vulnerabilities, provide updates over a defined period (generally at least 5 years), supply security information and an SBOM (software bill of materials) and report actively exploited vulnerabilities. The CE mark is in future also to prove cybersecurity. Open source is in principle included if commercial, with special rules for foundations (“steward”).

What to do?

• Check applicability (industry, size, role in the supply chain).
• Inventory: systems, data, suppliers.
• Build a minimum standard (BSI Grundschutz, ISO 27001, TOMs).
• Define and practise an incident reporting process.
• Bind suppliers by contract.
• Developers: secure development practices, SBOM, vulnerability reporting (security.txt), update process. Even small providers benefit from the fact that customers increasingly demand evidence.

See also: ISO 27001 and BSI Grundschutz, TOMs, BSI Act, Responsible disclosure