Cybersecurity Tracker
Cybersecurity tracker expanded to include a benchmark monitoring progress of the implementation of the NIS2 Directive in the EU
We’ve added a new benchmark on the Implementation of the NIS2 Directive to our Cybersecurity Tracker. It benchmarks progress across the EU in transposing the directive, including relevant legal instruments, national cybersecurity strategies, designation of competent authorities, definitions of digital and essential services, required responses to data breaches and financial penalties. The deadline for Member States to transpose the directive into national law passed on 17 October 2024; however, out of the EU27, only six had done so on time (Belgium, Croatia, Hungary, Italy, Latvia and Lithuania).
On the whole, these countries appear to have transposed the directive directly into national law. For instance, the scope of digital services tends to include online search engines, online marketplaces and cloud computing services, although Lithuania’s definition includes social networks too. A further slight divergence is reflected in Hungary’s approach to responding to data breaches, which will require operators to be given an auditor that must report back to the relevant authorities if a significant cybersecurity incident takes place internally.
A number of countries have drafted the required legislation, aiming to start the implementation process in the near future. Sweden, for example, has set its sights on introducing new cybersecurity legislation on 1 January 2025. The Government’s report there on an inquiry into the implementation of NIS2 proposes that new national legislation closely follows the NIS2 Directive, but recommends a slightly different approach to administrative fines, proposing a minimum penalty of SEK5,000 (£359/€432) for a breach of the law.
Other countries seem further away from implementing the directive. The Netherlands’s draft legislation has proposed enforcement from Q3 2025, while Finland, Germany and Ireland are yet to establish clear timeframes for when they will transpose the directive. Across the rest of the bloc, the remaining Member States are yet to publish draft legislation or officially outline their approach to transposing the directive.
