The Network and Information Security Directive (NIS) is an EU directive that aims to improve cyber security and the resilience of network and information systems in the European Union. 
The NIS-2 Directive (Directive (EU) 2022/2555) came into force on January 16, 2023, and member states had until October 17, 2024, to implement it into national law. These are the most important changes that result from the incorporation of the NIS-2 regulation into national law:

• Expanded scope of application: The NIS 2 Regulation covers more sectors and companies, including medium and small-sized companies in certain high-risk sectors. Newly added sectors include, for example, waste management, public administration, space travel and the manufacture of certain critical products.
• Higher security requirements: Companies must implement stricter technical and organizational measures to protect their network and information systems. This includes, among other things, protecting against cyber attacks, ensuring business continuity and minimizing risks.
• Improved reporting requirements: The regulation introduces more precise and stringent reporting requirements. Companies must report cyber incidents on a preliminary basis within 24 hours of discovery and then submit a detailed report within 72 hours.
   
• Stronger enforcement mechanisms and sanctions: The NIS 2 Regulation provides for tougher sanctions for non-compliance with the security requirements. This can result in significant fines. National authorities are given more powers to enforce the rules and monitor companies.
• Risk management and reporting: Companies must conduct regular risk assessments and implement appropriate security measures. They must also report regularly on their security posture and incidents.