NIS2 Consulting service aims to develop and implement an information security system in accordance with the NIS 2 Directive. The NIS 2 Directive aims to strengthen cybersecurity regulations across the European Union by imposing measures, obligations and sanctions on a wide range of businesses operating in sectors and services vital to key social and economic activities.
According to the NIS 2 directive, companies that are required to comply are categorized into two groups based on 2 criteria: the scope of their activity and their size (number of employees and turnover). Companies are divided into “Essential” entities (high criticality) and “Important” entities (normal criticality).
The NIS 2 directive imposes key cybersecurity measures that focus on risk management, requiring companies to conduct regular risk assessments, implement technical and organizational safeguards (e.g. firewalls and access controls) and establish procedures to detect, report and response to security incidents. In addition, it includes measures to prevent incidents, minimize their impact and ultimately, maintain a level of safety.
For both “Essential” and “Important” entities, the NIS 2 directive imposes stricter incident reporting requirements compared to the previous NIS Directive, regarding the timely notification of the Greek competent authority, the other Member States, their customers and of the public. Companies that do not follow the cyber security measures of the NIS 2 directive are fined with heavy financial penalties, which are imposed and determined by the Greek authority based on the seriousness of the non-compliance. However, the sanctions are not limited to financial fines, as the operation of the business is limited or even suspended in some cases, while the reputation of the company is significantly damaged.
