Does NIS2 require a specific security tool, such as intrusion detection?
No. NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. is technology-neutral: Article 21 requires appropriate and proportionate measures that take into account the state of the art, relevant standards and the cost of implementation, but it names no product category. In practice you cannot handle incidents (Article 21(2)(b)) or report them on time (Article 23) without some way of detecting them, so most entities use a combination of endpoint protection, log collection and network detection, scaled to their risk. National laws can be more specific for some entities: Germany's section 31(2) of the BSIG requires operators of critical installations to use systems for attack detection, while other particularly important and important entities fall under the general measures of section 30. Choose tools by the risks in your assessment, and document why.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- What happens if we grow or acquire a company and cross the NIS2 size threshold?
- Who decides whether our company is in NIS2 scope?
- Do we have to register under NIS2, and with whom?
- Why are our customers suddenly sending NIS2 supplier questionnaires?
- How do we answer “do you have intrusion detection?” on a customer questionnaire?
Terms used here
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.