Do we have to register under NIS2, and with whom?
Usually yes, if you are in scope, with the authority your national law names. Article 3(4) of NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. requires Member States to establish a list of essential and important entities and to require entities to submit at least their name, address and up-to-date contact details including e-mail addresses, IP ranges and telephone numbers, their Member State and their sector and subsector. Certain digital providers, such as DNS and cloud providers, data centres, managed service and managed security service providers, register under Article 27 in the country of their main establishment. The procedure and deadline are national: in Germany, section 33 of the BSIG requires registration with the BSI within three months of first counting as an entity and changes within two weeks. Check your own country's portal and keep the confirmation.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Why are our customers suddenly sending NIS2 supplier questionnaires?
- How do we answer “do you have intrusion detection?” on a customer questionnaire?
- What should a company do first to prepare for NIS2?
- How does a small or mid-sized company do a cyber risk assessment for NIS2?
- Has my country transposed NIS2 into national law yet?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.