What It Is

NIS2, officially Directive (EU) 2022/2555, is an EU regulation expanding the original NIS Directive. It establishes a high common level of cybersecurity resilience for critical infrastructure and digital services across member states. Primary scope covers essential and important entities in sectors like energy, transport, health, and digital providers. It employs a risk-based, all-hazards approach with continuous assurance.

Key Components

• Four pillars: risk management, corporate accountability, incident reporting, business continuity.
• Mandates ongoing risk assessments, supply chain security, access controls, encryption.
• Strict reporting: early warning (24h), detailed (72h), final (1 month).
• Builds on standards like ISO 27001, NIST CSF; no formal certification but national enforcement with spot checks.

Why Organizations Use It

Legal compliance avoids fines up to 2% global turnover. Enhances resilience against threats, builds stakeholder trust, ensures business continuity. Provides competitive edge in regulated sectors, supports cross-border cooperation.

Implementation Overview

Applies to medium/large entities (>50 employees, >€10M turnover) in EU-covered sectors. Involves gap analysis, policy updates, training, incident procedures. Tailor to national transpositions (by Oct 2024); ongoing audits, no central certification.

What It Is

UK General Data Protection Regulation (UK GDPR) is the UK's post-Brexit data protection law, adapted from EU GDPR alongside the Data Protection Act 2018. It establishes a risk-based, accountability-focused framework for processing personal data, applying to UK-established organisations and those targeting UK individuals extra-territorially.

Key Components

• **Seven core principleslawfulness, purpose limitation, minimisation, accuracy, storage limitation, security, accountability.
• **Data subject rightsaccess, rectification, erasure, portability, objection.
• Controller/processor obligations, DPIAs for high-risk processing, 72-hour breach notifications to ICO.
• No certification; compliance demonstrated via records, audits, governance.

Why Organizations Use It

• Mandatory legal compliance enforced by ICO fines up to 4% global turnover.
• Mitigates risks from breaches, litigation; builds trust, operational efficiency.
• Enables cross-border business, competitive differentiation via privacy maturity.

Implementation Overview

• Phased: gap analysis, RoPA mapping, policies, training, DPIAs, vendor contracts.
• Applies universally to data handlers; suits all sizes via proportionality.
• No formal certification; ICO audits, self-demonstration via documentation.