As cyber threats become increasingly prevalent across Europe, the security of digital infrastructures has become a critical priority. To address these growing challenges and vulnerabilities, the European Union has adopted the Directive on Security of Network and Information Systems (NIS2). This new directive builds on the original NIS Directive and introduces more robust protection measures for critical sectors and essential services.
NIS2 aims to strengthen cybersecurity across the EU by introducing stricter requirements, expanding the scope of covered sectors, and implementing more effective enforcement mechanisms. It ensures that EU member states are better equipped to respond to and prevent cyber threats.
NIS2 is the updated EU regulation designed to manage cybersecurity risks in critical sectors. It replaces the 2016 NIS Directive, incorporating lessons learned from its implementation and adapting to the evolving threat landscape.
The directive mandates the implementation of cybersecurity measures across a broader range of sectors and organizations. It harmonizes risk management procedures, incident reporting obligations, and resilience protocols throughout the EU.
With the transposition of the NIS2 Directive into Hungarian law, the previous "Cybersecurity Act" has been replaced by Act LXIX of 2024 on Hungary’s Cybersecurity. Implementation and technical requirements are defined by Government Decree 418/2024 and Decree 7/2024 (MK).
Organizations falling under the directive must ensure the protection of the information systems they operate, in proportion to the potential damage that cyber threats could cause.
The cybersecurity framework must cover the following areas:
The protection measures are primarily based on the principles outlined in NIST SP 800-53 Rev.5.
The NIS2 Directive applies to both public and private sector entities that qualify at least as medium-sized enterprises and provide services or conduct business within the EU.
In certain critical sectors, the directive applies regardless of company size, even to small businesses if their operations have significant cybersecurity relevance.
Risk-sensitive sectors include:
Highly critical sectors include:
The NIS2 Directive sets strict deadlines for compliance. Organizations must meet all requirements by the specified dates.
Supervisory authorities may impose sanctions, including warnings, mandatory remediation, suspension of high-risk activities, or fines of up to €10 million or 2% of global annual turnover. Organizations may also be required to notify customers of relevant threats.
Organizations must demonstrate compliance with the following protocols through independent audits every two years:
An IT security GAP analysis compares the current state of information security measures with the optimal state, identifying gaps and opportunities for development. Based on the results, well-founded decisions can be made to align IT security, efficiency, and business goals.
The GAP analysis is not just a technical review—it is a strategic tool that helps companies comply with international standards, meet market expectations, and address client requirements. Independent expert reviews ensure secure, transparent, and efficient operations, while minimizing risks to data integrity and business continuity.
Contact us with confidence to strengthen your company’s cybersecurity and achieve full NIS2 compliance! We are here to help you meet regulatory requirements and manage risks effectively.
