What It Is

NIS2 Directive (EU) 2022/2555 is an EU regulation expanding the original NIS Directive to achieve a high common level of cybersecurity resilience across member states. It targets essential and important entities in broadened sectors like energy, transport, health, and digital infrastructure, using a risk-based approach with continuous assurance rather than static compliance.

Key Components

• Four pillars: risk management, incident reporting, business continuity, corporate accountability.
• Strict timelines: 24-hour early warnings, 72-hour notifications, one-month final reports.
• Mandates supply chain security, access controls, encryption, and dynamic risk registers.
• Builds on standards like ISO 27001; no formal certification but national enforcement with spot checks.

Why Organizations Use It

Essential for legal compliance to avoid fines up to 2% global turnover. Enhances cyber resilience, protects critical services, builds stakeholder trust, and mitigates threats like supply chain attacks. Provides competitive edge through proactive security in interconnected sectors.

Implementation Overview

Applies to medium/large entities (50+ employees, €10M+ turnover) in EU-covered sectors. Involves risk assessments, training, governance structures, and registering with national CSIRTs. Tailor to member state variations; transposition by October 2024, with 12-18 month grace periods in some countries. Focus on ongoing evidence-based practices.

What It Is

ISO/IEC 17025:2017—General requirements for the competence of testing and calibration laboratories—is the principal international accreditation standard. It establishes a risk-based framework linking management system controls to technical validity, ensuring impartial, traceable, and consistent laboratory results for global acceptance.

Key Components

• **Eight core clausesGeneral (impartiality/confidentiality), Structural, Resource requirements (personnel competence, facilities, equipment traceability), Process requirements (methods, sampling, uncertainty, reporting), Management System (Option A standalone or B with ISO 9001).
• Emphasizes metrological traceability, measurement uncertainty, proficiency testing.
• Built on risk-based thinking and performance outcomes.

Why Organizations Use It

• Enables regulatory compliance and market access via ILAC mutual recognition.
• Mitigates risks of invalid results impacting safety, finance, reputation.
• Builds customer trust, operational efficiency, competitive differentiation.

Implementation Overview

• Phased PDCA: gap analysis, documentation, validation/training, internal audits, accreditation assessments with witnessed activities.
• Applies globally to labs of all sizes in testing/calibration sectors.