The European Union has adopted the NIS2 Directive to enhance cybersecurity regulations in response to rising digital threats that jeopardize economic, social, and geopolitical security across Europe.

NIS2 operates in conjunction with other European regulations, such as DORA and the CER Directive, to create a comprehensive regulatory framework for cybersecurity across various sectors.

Telefónica is actively engaged in supporting compliance with NIS2 through public policy initiatives, operational security centers, and risk management solutions tailored for businesses.

This directive broadens its scope to encompass critical sectors including health, food, water, and public administration, while introducing a classification system for institutions based on their risk profiles.

Under NIS2, entities face stricter obligations, which include enhanced risk management practices, continuity plans, supply chain cybersecurity measures, and a requirement to report serious incidents within 24 hours.

The directive emphasizes the importance of clear governance, mandating that management bodies of essential entities appoint responsible individuals and implement structured cybersecurity management.

Businesses in sectors such as telecommunications, energy, and health must conduct ongoing risk assessments, monitor suppliers, and track real-time activities to ensure compliance with NIS2.

The transposition of NIS2 marks a significant shift towards bolstering Europe's digital resilience and ensuring the continuity of essential services in the face of geopolitical challenges.

In Germany, the transposition process for NIS2 is currently in progress, having been delayed due to the dissolution of the federal government, with a new draft anticipated within the first 100 days of the new administration.

In Spain, the Ministry of the Interior is spearheading the regulatory adaptation process, which is expected to impact over 5,000 companies across 18 sectors, with new authorities designated to oversee compliance.