The revised EU directive on the security of network and information systems (NIS2) imposes on critical entities (e.g. cloud providers, data centres, social media platforms) common security risk management and reporting requirements. Importantly, the NIS2 will also regulate the security of telecoms operators when providing both telecoms related services (e.g. mobile services) and non-telecoms services (e.g. cloud).
To build on the telecoms sector-specific knowledge already acquired under the European Electronic Communications Code (EECC), existing national guidelines adopted to transpose the EECC security provisions should be considered when implementing the NIS2 security requirements. Further, the revised directive encourages the use of encryption technologies (e.g. end-to-end encryption) and data-centric concepts such as segmentation.
The revised directive will subject providers active in the ICT supply chain, as well as some cross-border digital entities (e.g. online marketplaces, online search engines) to a higher degree of harmonisation. This will include EU level technical measures and procedures to demonstrate compliance with the security obligations of the NIS2.
In addition, the NIS2 Directive introduces a clear obligation on essential and important entities across all the sectors within its scope to assess the security level of their ICT products, services, and systems.
To assist entities in managing supply chains and supplier related cybersecurity risks, the NIS Cooperation Group is expected to prepare an ICT supply chain security toolbox (possibly in 2023). The toolbox should identify threat scenarios specific to ICT supply chains and provide generic security measures to respond to the threat scenarios.
Cullen International is releasing a series of reports on the different aspects of the newly revised directive on the security of network and information systems (NIS2). Our third of five reports covers certain security obligations which apply specifically to the telecoms, ICT supply chain and digital sectors.
See also:
Part 1: Scope
Part 2: Common security risk management and reporting requirements
For more information and to access our NIS2 report series, please click on “Access the full content” - or on “Request Access”, in case you are not subscribed to our European Digital Economy service.
more news
24 March 26
Middle East tightens oversight of IoT connectivity as roaming and licensing frameworks evolve
Cullen International’s latest analysis shows that, while some MENA countries allow IoT connectivity through cross-border roaming arrangements, others increasingly rely on telecommunications licensing frameworks and identity verification requirements to regulate connected devices.
23 March 26
National frameworks for high-risk suppliers in Europe
Cullen International’s latest benchmarks on national frameworks addressing security concerns associated with high-risk suppliers (HRS) survey the scope of the frameworks (whether limited to 5G networks or also extending to other telecoms networks or critical sectors), as well as the measures implemented to restrict or ban HRS in 5G networks (including concrete restrictions in practice).
20 March 26
Authorities in the Americas rely on existing competition law frameworks to address the market power of online platforms
This new benchmark covers how countries in the Americas address the market power of online platforms. It examines recent legislative developments, as well as selected competition law cases in which authorities assessed the conduct or mergers of major digital platforms.