Article 1Subject matter
1. This Directive lays down measures that aim to achieve a high common level of cybersecurity across the Union, with a view to improving the functioning of the internal market.
2. To that end, this Directive lays down:
(a) obligations that require Member States to adopt national cybersecurity strategies and to designate or establish competent authorities, cyber crisis management authorities, single points of contact on cybersecurity (single points of contact) and computer security incident response teams (CSIRTs);
(b) cybersecurity risk-management measures and reporting obligations for entities of a type referred to in Annex I or II as well as for entities identified as critical entities under Directive (EU) 2022/2557;
(c) rules and obligations on cybersecurity information sharing;
(d) supervisory and enforcement obligations on Member States.
NIS2, the European Union directive on network and information security, Article 1
The Directive’s statement of purpose: a high common level of cybersecurity across the Union, to improve the functioning of the internal market. It does four things. It requires Member States to adopt national cybersecurity strategies and to designate or establish competent authorities, cyber crisis management authorities, single points of contact and CSIRTs. It sets cybersecurity risk-management and reporting obligations for entities of the types listed in Annexes I and II and for entities identified as critical under Directive (EU) 2022/2557. It sets rules and obligations on cybersecurity information sharing. And it places supervision and enforcement obligations on Member States.
Read the list for who is addressed. The first and last limbs are duties of the State. The second is about what entities must do, but Articles 21 and 23 make it a duty of Member States to ensure it, so it reaches an organisation through national law and not directly. An entity that has read this Directive has read what its Member State was required to bring about. The operative text for that entity is the national law of the State with jurisdiction over it.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.