Network and Information Security Directive (NIS2-RL)/en - Versionsgeschichte

Jhospes: Die Seite wurde neu angelegt: „* The affected systems’ role in service delivery * Severity and technical nature of the threat * Underlying vulnerabilities * Past experience with similar incidents“

2025-06-03T13:04:36Z

Die Seite wurde neu angelegt: „* The affected systems’ role in service delivery * Severity and technical nature of the threat * Underlying vulnerabilities * Past experience with similar incidents“

← Nächstältere Version		Version vom 3. Juni 2025, 13:04 Uhr
Zeile 584:		Zeile 584:
	</div>		</div>

	<~~div lang~~="~~de" dir="ltr" class="mw-content-ltr~~">		<span id="Einführungswerke"></span>
	=== ~~Einführungswerke~~ ===		=== Introductory Works ===
	~~</div>~~

	<div lang="de" dir="ltr" class="mw-content-ltr">		<div lang="de" dir="ltr" class="mw-content-ltr">
Zeile 592:		Zeile 591:
	</div>		</div>

	<~~div lang~~="~~de" dir="ltr" class="mw-content-ltr~~">		<span id="Sammelwerke"></span>
	=== ~~Sammelwerke~~ ===		=== Collected Volumes ===
	~~</div>~~

	<div lang="de" dir="ltr" class="mw-content-ltr">		<div lang="de" dir="ltr" class="mw-content-ltr">
Zeile 603:		Zeile 601:
	</div>		</div>

	<~~div lang~~="~~de" dir="ltr" class="mw-content-ltr~~">		<span id="Kommentare"></span>
	=== ~~Kommentare~~ ===		=== Commentary ===
	~~</div>~~

	<div lang="de" dir="ltr" class="mw-content-ltr">		<div lang="de" dir="ltr" class="mw-content-ltr">
Zeile 611:		Zeile 608:
	</div>		</div>

	<~~div lang~~="de" ~~dir~~=~~"ltr" class~~=~~"mw-content-ltr">~~		<span id="Einzelnachweise"></span>
	== ~~Einzelnachweise~~ ==		=== Sources ===
	~~</div>~~

Jhospes: Die Seite wurde neu angelegt: „Note: Alerts forwarded to the operator do not qualify as formal reports under § 34 NISGS. 21.“

2025-06-03T12:56:20Z

Die Seite wurde neu angelegt: „Note: Alerts forwarded to the operator do not qualify as formal reports under § 34 NISG<ref>S. 21</ref>.“

← Nächstältere Version		Version vom 3. Juni 2025, 12:56 Uhr
Zeile 257:		Zeile 257:
	Measures must follow a cross-hazard approach, covering both cybersecurity and physical security (§ 32(2)(2) NISG), including:		Measures must follow a cross-hazard approach, covering both cybersecurity and physical security (§ 32(2)(2) NISG), including:

	~~<div lang="de" dir="ltr" class="mw-content-ltr">~~		These include:
	~~Dies umfasst~~:
	~~</div>~~

	* Protection from system failures, human error, malicious acts, and natural events		* Protection from system failures, human error, malicious acts, and natural events
Zeile 285:		Zeile 283:
	The NIS2 Directive introduces specific governance obligations targeting the executive and management levels, emphasizing their active role. Key aspects include:		The NIS2 Directive introduces specific governance obligations targeting the executive and management levels, emphasizing their active role. Key aspects include:

	~~<div lang="de" dir="ltr" class="mw-content-ltr">~~		Main aspects are:
	~~Zu den Hauptaspekten gehören~~:
	~~</div>~~

	* Accountability: Corporate leadership (e.g., board, management) is responsible for approving and overseeing the implementation of risk management obligations.		* Accountability: Corporate leadership (e.g., board, management) is responsible for approving and overseeing the implementation of risk management obligations.
Zeile 383:		Zeile 379:
	Recital 101 NIS2 provides interpretative guidance. Implementing Regulation (EU) 2024/2690 further specifies what constitutes a significant incident for certain entities.		Recital 101 NIS2 provides interpretative guidance. Implementing Regulation (EU) 2024/2690 further specifies what constitutes a significant incident for certain entities.

	~~<div lang="de" dir="ltr" class="mw-content-ltr">~~		In addition, [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202402690 Implementing Regulation (EU) 2024/2690] defines what constitutes a significant cybersecurity incident for certain entities.
	~~Daneben definiert die~~ [https://eur-lex.europa.eu/legal-content/DE/TXT/?uri=OJ:L_202402690 ~~Durchführungsverordnung~~ (EU) 2024/2690] ~~für bestimmte Einrichtungen was als erheblicher Sicherheitsvorfall zu qualifizieren ist~~.
	~~</div>~~

	<span id="Fallbeispiel"></span>		<span id="Fallbeispiel"></span>
	=== Case Study ===		=== Case Study ===

	~~<div lang="de" dir="ltr" class="mw-content-ltr">~~		The company NisExperts AG is an IT service provider based in Styria, employing 66 staff members and recording an annual balance sheet total of nine million euros. NisExperts AG operates several data centers that host the IT infrastructure for multiple Austrian hospitals and the control system of a major Styrian network operator. On Friday afternoon at 4:00 p.m., the Security Operations Center (SOC) of NisExperts AG detects an unusually high number of requests targeting the firewalls of one of its data centers. Upon analysis, it is determined that the incident involves a Distributed Denial of Service (DDoS) attack targeting a core platform of the company.
	~~Das Unternehmen~~ NisExperts AG ~~ist ein Anbieter von~~ IT~~-Diensten mit Sitz~~ in ~~der Steiermark~~, ~~beschäftigt~~ 66 ~~Mitarbeitende und erzielt eine Jahresbilanzsumme von neun Millionen Euro~~. NisExperts AG ~~betreibt mehrere Rechenzentren, in welchen die~~ IT~~-Infrastruktur für mehrere österreichische Krankenhäuser und das Netzleitsystem eines wichtigen steirischen Netzbetreibers untergebracht ist~~. ~~Freitagnachmittag um 16~~:00 ~~Uhr registriert das~~ Security Operations Center (SOC) ~~von~~ NisExperts AG ~~eine ungewöhnlich hohe Anzahl von Anfragen, die gegen die Firewalls eines Rechenzentrums gerichtet sind~~. ~~Nach einer Analyse stellt sich heraus~~, ~~dass es sich um eine DDoS-Attacke (~~Distributed Denial of Service) ~~handelt, die eine zentrale Plattform des Unternehmens ins Visier nimmt~~.
	~~</div>~~

	On Friday at 4:00 p.m., its SOC detects a high volume of traffic targeting the firewalls of one data center. The attack is identified as a Distributed Denial of Service (DDoS) targeting a central company platform. Despite DDoS protection, attackers temporarily overload systems.		On Friday at 4:00 p.m., its SOC detects a high volume of traffic targeting the firewalls of one data center. The attack is identified as a Distributed Denial of Service (DDoS) targeting a central company platform. Despite DDoS protection, attackers temporarily overload systems.

Jhospes: Die Seite wurde neu angelegt: „The regulation of risk management measures under NIS2 follows a risk-based and proportionate approachhttps://www.handelsverband.at/fileadmin/content/Presse_Publikationen/Presseaussendungen/2024/03_Mar/2024-03_HV_NIS2-Leitfaden_extra.pdf. Companies must consider the following factors when implementing security measures:“

2025-06-03T12:53:24Z

Die Seite wurde neu angelegt: „The regulation of risk management measures under NIS2 follows a risk-based and proportionate approach<ref>https://www.handelsverband.at/fileadmin/content/Presse_Publikationen/Presseaussendungen/2024/03_Mar/2024-03_HV_NIS2-Leitfaden_extra.pdf</ref>. Companies must consider the following factors when implementing security measures:“

← Nächstältere Version		Version vom 3. Juni 2025, 12:53 Uhr
Zeile 38:		Zeile 38:
	\|}		\|}

	~~{\| class="wikitable"~~		For both, the higher amount applies.
	~~!Goals~~		\|-
	~~!Scope~~		\| Containment of threats in key sectors (Recital 1 NIS2 Directive)
	~~!Content<ref>https://www.nis.gv~~.~~at/nis-2-richtlinie.html</ref>~~		\| Must be implemented by Member States by 17 October 2024 (not yet done)
	~~!Synergy~~		\| Obligations regarding cybersecurity risk management (Art. 20 et seq. NIS2 Directive) and reporting obligations (Art. 23 NIS2 Directive) for affected entities
	~~!Consequences~~		\| Confidentiality clauses
	\|-		\| Official instructions and orders. Suspension of operations can also be ordered (Art. 32 NIS2 Directive)
	~~\|Development of cybersecurity capabilities (Recital 1 NIS2)~~
	~~\|Annex I (high-criticality sectors)~~
	~~\|Obligation for all MS to adopt national cybersecurity strategies (Art 7 NIS2)~~
	~~\|Data protection management system~~
	~~\|Essential entities: fines of at least EUR 10 million or 2% of global annual turnover~~
	\|-
	\|~~Achieving a high common level of cybersecurity (Art 1 NIS2)~~
	~~\|Annex II (other critical sectors) if thresholds in Art 2(1) of the Annex to Recommendation 2003/361/EC are exceeded~~
	~~\|Obligation for MS to define various responsibilities and enforcement duties (Art 31 et seq. NIS2)~~
	~~\|Security of processing (Art 32 GDPR)~~
	~~\|Important entities: maximum fine of at least EUR 7 million or 1.4%~~ of ~~global annual turnover, whichever is higher~~
	\|-
	~~\|Mitigating~~ threats in key sectors (Recital 1 NIS2)
	\|To be ~~transposed~~ by MS by 17 October 2024 (not yet done)
	\|Obligations regarding cybersecurity risk management (Art 20 et seq. NIS2) and reporting (Art 23 NIS2)
	\|Confidentiality clauses
	\|~~Administrative~~ orders ~~and instructions~~. Suspension of ~~activity~~ also ~~possible~~ (Art 32 NIS2)
	\|-		\|-
	\|		\|
	\|		\|
	\|~~Provisions~~ and obligations on ~~sharing~~ cybersecurity information (Art 29 et seq. NIS2)		\| Rules and obligations on the exchange of cybersecurity information (Art. 29 et seq. NIS2 Directive)
	\|		\|
	\|Management bodies ~~can~~ be held personally liable (Art 20 NIS2)		\| Management bodies may be held personally liable (Art. 20 NIS2 Directive)
	\|}		\|}

Jhospes: Die Seite wurde neu angelegt: „=== Overlaps ===“

2025-06-03T12:51:47Z

Die Seite wurde neu angelegt: „=== Overlaps ===“

Änderungen zeigen

Jhospes: Die Seite wurde neu angelegt: „===== Size-dependent Scope =====“

2025-06-03T11:56:14Z

Die Seite wurde neu angelegt: „===== Size-dependent Scope =====“

Änderungen zeigen

Jhospes: Die Seite wurde neu angelegt: „An "entity" under § 3(10) NISG is a natural person or a legal person or registered partnership recognized under the applicable national law, capable of exercising rights and bearing obligations in its own name.“

2025-06-03T11:52:08Z

Die Seite wurde neu angelegt: „An "entity" under § 3(10) NISG is a natural person or a legal person or registered partnership recognized under the applicable national law, capable of exercising rights and bearing obligations in its own name.“

Änderungen zeigen

Jhospes: Die Seite wurde neu angelegt: „{| class="wikitable" !Goals !Scope !Contenthttps://www.nis.gv.at/nis-2-richtlinie.html !Synergy !Consequences |- |Development of cybersecurity capabilities (Recital 1 NIS2) |Annex I (high-criticality sectors) |Obligation for all MS to adopt national cybersecurity strategies (Art 7 NIS2) |Data protection management system |Essential entities: fines of at least EUR 10 million or 2% of global annual turnover |- |Achieving a high common level of cy…“

2025-06-03T11:01:49Z

Die Seite wurde neu angelegt: „{| class="wikitable" !Goals !Scope !Content<ref>https://www.nis.gv.at/nis-2-richtlinie.html</ref> !Synergy !Consequences |- |Development of cybersecurity capabilities (Recital 1 NIS2) |Annex I (high-criticality sectors) |Obligation for all MS to adopt national cybersecurity strategies (Art 7 NIS2) |Data protection management system |Essential entities: fines of at least EUR 10 million or 2% of global annual turnover |- |Achieving a high common level of cy…“

Änderungen zeigen