Our NIS2 working group continues to gather professional experience related to the domestic regulation and its practical application. We continue to welcome comments, suggestions and questions on the NIS2 subpage of our website - even anonymously.
The domestic introduction of the European Union's NIS2 Directive (2022/2555/EU) has brought significant changes to the operations of many organizations. Recent experience shows that many practical questions arise from obligated organizations, consultants, information security officers and auditors regarding implementation, audits, identification of EIRs and definition of the scope of stakeholders.
Our NIS2 working group was established with the aim of collecting, systematizing and forwarding this experience to the legislative side. Our aim is to establish a broader professional dialogue that will allow the necessary modifications and clarifications to be made based on professional consensus.
The subpage already contains a number of substantive comments. The submitters suggest, among other things, a phased, maturity-based introduction of requirements, a simplified requirements system for smaller organizations, and the development of separate OT/ICS, cloud security, and AI security methodologies. Recurring themes include the lack of uniform regulatory guidelines and evidence catalogs, the distorting effects of the audit fee system, the scarcity of auditor capacity, and the risk that compliance becomes too document-centric at the expense of real, operational cybersecurity capabilities. Several suggestions also emphasize the importance of strengthening leadership responsibility and education, as well as a predictable regulatory environment.
Thank you to all the submitters so far for sharing their experiences with us!
How can I join the dialogue?
THE On the NIS2 subpage We continue to welcome experiences and suggestions related to the domestic requirements of NIS2, their application and applicability via the form found here. Questions can also be asked to the experts of our working group here – including on the topics of risk management, incident reporting, supply chain security or compliance documentation. Submissions can also be made anonymously; if you consent, we will display the suggestions on the site for further joint thinking and professional discourse.
All comments contribute to ensuring that the domestic application of NIS2 can develop in a direction that is more aligned with the real operations of organizations, proportionate and that actually strengthens the level of cybersecurity.
Submit comments and questions: cybercluster.hu/nis2