TFL Vsebine / Revija SIR*IUS

EU Cyber Security Update: From NIS 2 to Cyber Solidarity

Direktiva NIS je bila prvi akt, ki je področje kibernetske varnosti urejal na ravni EU-ja. Šest let kasneje je bila sprejeta nova direktiva – NIS 2, s katero želi EU dodatno izboljšati kibernetsko odpornost in odzivnost javnega in zasebnega sektorja ter Unije kot celote. Z direktivo NIS 2 je tudi uradno vzpostavljena Evropska organizacijska mreža za povezovanje v kibernetski krizi (EU-CyCLONe),ki podpira usklajeno upravljanje velikih kibernetskih incidentov. Direktiva razširja seznam zavezancev, deli jih na bistvene in pomembne subjekte, ki bodo dolžni v 24 urah poročati o varnostnih incidentih ter v enem mesecu o incidentu in vzroku ter vpeljanih in načrtovanih ukrepih za odpravljanje tveganj. Podobno kot Splošna uredba o varstvu podatkov – GDPR tudi direktiva NIS 2 predvideva visoke globe za kršitev določil. Poleg direktive NIS 2 sta bili decembra 2022 na sektorskem področju sprejeti še Direktiva o odpornosti kritičnih subjektov (direktiva CER) in Uredba o digitalni operativni odpornosti za finančni sektor. Aktivnosti EU-ja na področju zagotavljanja varnega in odpornega kibernetskega prostora se nadaljujejo tudi v letu 2023. Evropska komisija je aprila sprejela predlog Akta EU o kibernetski solidarnosti, da bi se okrepila zmogljivost v EU-ju za odkrivanje pomembnih in obsežnih kibernetskih groženj in napadov ter odzivanje nanje.

The NIS Directive was the first legislative act that regulated the field of cyber security at the EU level. Six years later EU adopted the new NIS 2 directive, with which it aims to further improve the cyber resilience and responsiveness of the public and private sectors and the EU as a whole. The NIS 2 directive established the European cyber crisis liaison organisation network (EU-CyCLONe), which supports the coordinated management of major cyber incidents. The directive also expands the list of the obligated and divides them into essential and important entities, which will be obliged to report security incidents within 24 hours and within one month to report the incident and the cause, as well as their implemented and planned measures to eliminate the risks. Similar to the General Data Protection Regulation - GDPR, the NIS 2 directive also foresees high fines for violation of its provisions. In addition to the NIS 2 directive, the Directive on the Resiliencof Critical Entities (CER Directive) and the Regulation on Digital Operational Resilience for the Financial Sector were also adopted in the sector in December 2022. Activities in the field of ensuring a safe and resilient cyber space continue in 2023, namely in April the European Commission adopted a proposal for an EU Cyber Solidarity Act with the aim of strengthening the EU’s capacity to detect and respond to significant and large-scale cyber threats and attacks.