{"id":5383,"date":"2024-10-14T09:06:32","date_gmt":"2024-10-14T07:06:32","guid":{"rendered":"https:\/\/www.b2c-engineering.com\/?p=5383"},"modified":"2026-02-09T13:57:25","modified_gmt":"2026-02-09T12:57:25","slug":"new-european-nis-2-directive","status":"publish","type":"post","link":"https:\/\/www.b2c-engineering.com\/en\/new-european-nis-2-directive\/","title":{"rendered":"NIS-2 Directive: risks, penalties and impacts for industry"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

update : jan. 2026<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

European NIS-2 Directive: strengthening cybersecurity for industrial players<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In<\/span> a<\/span> context<\/span> where<\/span> digital<\/span> security<\/span> has<\/span> become<\/span> a<\/span> major<\/span> issue<\/span>, the<\/span> new<\/span> NIS<\/span>–2<\/span> Directive<\/span> represents<\/span> a<\/span> decisive<\/span> turning<\/span> point<\/span>.<\/span> Its aim is to strengthen cybersecurity within the EU and it will come into force in our country in October. 2,400 companies are affected in Belgium and 66% of manufacturers surveyed by B2C Engineering have no idea what implications this will have for their business.<\/span><\/span><\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Background and objectives of the NIS-2 Directive<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

In<\/span> Li\u00e8ge<\/span>, Belgium<\/span>, and<\/span> across<\/span> Europe<\/span>, the<\/span> situation<\/span><\/strong> is<\/span> the<\/span> same<\/span>: many<\/span> companies<\/span> are<\/span> now<\/span> faced<\/span> with<\/span> obsolete<\/span> infrastructure<\/span> and<\/span> systems<\/span> marked<\/span> by<\/span> critical<\/span> vulnerabilities<\/span><\/strong>. This<\/span> urgency<\/span> is<\/span> further<\/span> accentuated<\/span> by<\/span> the<\/span> emergence<\/span> of<\/span> Industry<\/span> 4.0<\/span><\/strong>, which<\/span> relies<\/span>, among<\/span> other<\/span> things<\/span>, on<\/span> the<\/span> interconnection<\/span> and<\/span> complete<\/span> digitisation<\/span> of<\/span> industrial<\/span> processes<\/span>.<\/span><\/span> In this context of increasing digitalisation, equipment<\/strong> not originally designed for external use<\/strong> is now exposed on the internet, increasing the risk of loss of control.<\/span><\/p>

Cybersecurity is therefore becoming a priority<\/strong> not only for the protection of systems and production tools<\/strong>, but also for the safeguarding of sensitive data<\/strong> belonging to companies, their employees and their customers. Faced with the increased risk of data leaks, companies must comply with rigorous standards<\/strong> to prevent any breaches that could expose them to major legal and financial risks.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

A response to cybercrime for 2,400 Belgian companies<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The<\/span> NIS<\/span>–2<\/span> Directive<\/span> significantly<\/span> broadens<\/span> the<\/span> scope<\/span> of<\/span> organisations<\/span> subject<\/span> to<\/span> cybersecurity<\/span> obligations<\/span>, particularly<\/span> in<\/span> the<\/span> industrial<\/span> sector<\/span>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\u2018Cybercriminals<\/span> act<\/span> for<\/span> a<\/span> variety<\/span> of<\/span> reasons<\/span><\/strong>,\u2019 explains<\/span> Benjamin<\/span> Beaurang<\/span>, administrator<\/span> of<\/span> B2C<\/span> Engineering<\/span>, based<\/span> in<\/span> Fexhe<\/span>–le<\/span>–Haut<\/span>–Clocher<\/span> in<\/span> the<\/span> Li\u00e8ge<\/span> region<\/span>, but<\/span> also<\/span> operating<\/span> in<\/span> France<\/span>, Luxembourg<\/span> and<\/span> Switzerland<\/span>.<\/span><\/span><\/p>

\u2018The lure of financial gain<\/strong> is one of the main motivations, particularly through ransom demands in exchange for the return of stolen data or the restoration of IT systems. For others, hacking is a technical challenge<\/strong> and a source of entertainment<\/strong>, a way to test and demonstrate their skills.\u2019<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Gregory<\/span> Putman<\/span>, Sales<\/span> Specialist<\/span> Industrial<\/span> Networks<\/span> & Security<\/span> at<\/span> SIEMENS<\/span>, adds<\/span>: \u2018Other<\/span> cybercriminals<\/span> are<\/span> hired<\/span> by<\/span> companies<\/span> to<\/span> sabotage<\/span> the<\/span> competition<\/span><\/strong>. And<\/span> then<\/span> there<\/span> are<\/span> terrorist<\/span> motives<\/span><\/strong>, where<\/span> cyberattacks<\/span> aim<\/span> to<\/span> cause<\/span> significant<\/span> damage<\/span>, such<\/span> as<\/span> altering<\/span> the<\/span> water<\/span> supply<\/span> to<\/span> harm<\/span> the<\/span> population<\/span>.\u2019<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t

\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Portrait\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The<\/span> new<\/span> European<\/span> NIS<\/span>–2<\/span> Directive<\/span><\/strong> on<\/span> Network<\/span> and<\/span> Information<\/span> System<\/span> Security<\/span> must<\/span> be<\/span> transposed<\/strong><\/span> into<\/span> the<\/span> national<\/span> legislation<\/span> of<\/span> each<\/span> European<\/span> Union<\/span> member<\/span> state<\/span> by<\/span> 17<\/span> October<\/span> 2024<\/span><\/strong>. It<\/span> was<\/span> already<\/span> passed<\/span> in<\/span> Belgium<\/span> in<\/span> April<\/span> 2024<\/span>. It<\/span> is<\/span> intended<\/span> to<\/span> be<\/span> an<\/span> effective<\/span> response<\/span> to<\/span> cybercrime<\/span>, which<\/span> is<\/span> very<\/span> prevalent<\/span> in<\/span> Europe<\/span>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Which industrial companies are affected by the NIS-2 Directive?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Targeted industrial sectors and activities<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The<\/span> new<\/span> directive<\/span> will<\/span> now<\/span> apply<\/span> to<\/span> a<\/span> wider<\/span> range<\/span> of<\/span> companies<\/span>. It<\/span> will<\/span> cover<\/span> almost<\/span> all<\/span> medium<\/span>–sized<\/span> and<\/span> large<\/span> enterprises<\/span>. In<\/span> Belgium<\/span>, more<\/span> than<\/span> 2,400<\/span> companies<\/span> are<\/span> affected<\/span><\/strong> by<\/span> the<\/span> implementation<\/span> of<\/span> the<\/span> NIS<\/span>–2<\/span> directive<\/span>.<\/span><\/span><\/p>

This includes the energy, water, transport, health, chemical, pharmaceutical and agri-food sectors<\/strong>, as well as manufacturers operating critical infrastructure or systems<\/strong>.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The<\/span> directive<\/span> distinguishes<\/span> between<\/span> essential<\/span> entities<\/span><\/strong> and<\/span> important<\/span> entities<\/span>. This<\/span> classification<\/span> determines<\/span> the<\/span> level<\/span> of<\/span> regulatory<\/span> requirements<\/span><\/strong>, the<\/span> frequency<\/span> of<\/span> inspections<\/span><\/strong> and<\/span> the<\/span> severity<\/span> of<\/span> penalties<\/span><\/strong> in<\/span> the<\/span> event<\/span> of<\/span> non<\/span>–compliance<\/span>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

What are the obligations imposed by the NIS-2 Directive?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The<\/span> new<\/span> directive<\/span> will<\/span> now<\/span> apply<\/span> to<\/span> a<\/span> wider<\/span> range<\/span> of<\/span> companies<\/span>. It<\/span> will<\/span> cover<\/span> almost<\/span> all<\/span> medium<\/span>–sized<\/span> and<\/span> large<\/span> enterprises<\/span>. In<\/span> Belgium<\/span>, more<\/span> than<\/span> 2,400<\/span> companies<\/span> are<\/span> affected<\/span><\/strong> by<\/span> the<\/span> implementation<\/span> of<\/span> the<\/span> NIS<\/span>–2<\/span> directive<\/span>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"Portrait\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\u2018Currently<\/span>, many<\/span> manufacturers<\/span> are<\/span> reluctant<\/span> to<\/span> report<\/span> cyberattacks<\/span><\/strong> for<\/span> fear<\/span> of<\/span> losing<\/span> their<\/span> customers<\/span>‘ trust<\/span>. This<\/span> reluctance<\/span> often<\/span> leads<\/span> them<\/span> to<\/span> pay<\/span> the<\/span> ransoms<\/span> demanded<\/span> by<\/span> cybercriminals<\/span> in<\/span> order<\/span> to<\/span> avoid<\/strong><\/span> bad<\/span> publicity<\/span> and<\/span> preserve<\/span> their<\/span> image<\/span><\/strong>,\u2019 adds<\/span> Charles<\/span> Costa<\/span>, director<\/span> at<\/span> B2C<\/span> Engineering<\/span> and<\/span> cybersecurity<\/span> advisor<\/span>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Risk management, resilience and business continuity<\/h3>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

With<\/span> the<\/span> entry<\/span> into<\/span> force<\/span> of<\/span> the<\/span> NIS<\/span>–2<\/span> Directive<\/span> in<\/span> October<\/span>, specific<\/span> and<\/span> operational<\/span> cybersecurity<\/span> obligations<\/span> <\/strong>apply<\/span> to<\/span> both<\/span> IT<\/span> systems<\/span> and<\/span> industrial<\/span> OT<\/span> environments<\/span>.<\/span><\/span><\/p>

These<\/span> include<\/span>:<\/span><\/span><\/p>