NIS-2 Directive: Challenges for EU companies cybersecurity

Related Vendors

NIS-2 directive requires better communication

The majority of companies (72 percent) track the impact of vulnerabilities in an existing software supply chain all the way to the end customers. However, 39 percent do not or only occasionally inform them of such vulnerabilities. Thus, there is potential for optimization in dealing with end customers. But why is transparent communication often failing? Well, 37 percent cite a lack of personnel as a major obstacle. Another 37 percent simply want to avoid litigation. Often, management does not prioritize open communication with end customers (34 percent). In some companies (26 percent), there is just a lack of time, or there are too many other tasks. Additionally, 23 percent fear negative impacts on the company's reputation. But it is exactly this silence that potentially damages one's own reputation. In addition to implementing the NIS-2 directive, those responsible should also take this into account and act accordingly. The study thus identifies a need for action regarding the NIS-2 directive—and time is pressing. It is now crucial for companies to choose the right strategies and countermeasures for implementing the requirements. Blackberry can assist in this process, it concludes.

ECO Association warns of too short implementation time.

In this regard, ECO board member Klaus Landefeld says: "The federal government would do well to adhere more closely to the European guidelines in the national implementation of the NIS-2 directive." Because the risk that the regulatory framework would fall apart and that different rules would apply to Germany than to Europe, is great. Especially the classification as "operator of critical facilities" creates uncertainty for internationally active companies, which would have to follow different rules in the individual EU member states, according to Landefeld. The short implementation deadline also worries the association. Landefeld: "Many companies do not yet know that they are within the scope of the directive and the resulting legislation in Germany." Consequently, they have not yet prepared for the future requirements of the NIS2 directive. They also partly fail to determine their own affectation. The fact that the EU Commission is now publishing implementation legal acts specifically for providers of digital services, which must also be taken into account, creates additional uncertainty, according to the ECO board. The schedule to bring the draft law through the cabinet on time—and the subsequent parliamentary procedure—is now extremely tight. Therefore, it is quite likely that the start date of October 18, 2024, will be exceeded.

Subscribe to the newsletter now

Don't Miss out on Our Best Content

Business E-mail

Please enter a valid mailadress.

By clicking on „Subscribe to Newsletter“ I agree to the processing and use of my data according to the consent form (please expand for details) and accept the Terms of Use. For more information, please see our Privacy Policy. The consent declaration relates, among other things, to the sending of editorial newsletters by email and to data matching for marketing purposes with selected advertising partners (e.g., LinkedIn, Google, Meta)

Date: 08.12.2025

Naturally, we always handle your personal data responsibly. Any personal data we receive from you is processed in accordance with applicable data protection legislation. For detailed information please see our privacy policy.

Consent to the use of data for promotional purposes

I hereby consent to Vogel Communications Group GmbH & Co. KG, Max-Planck-Str. 7-9, 97082 Würzburg including any affiliated companies according to §§ 15 et seq. AktG (hereafter: Vogel Communications Group) using my e-mail address to send editorial newsletters. A list of all affiliated companies can be found here

Newsletter content may include all products and services of any companies mentioned above, including for example specialist journals and books, events and fairs as well as event-related products and services, print and digital media offers and services such as additional (editorial) newsletters, raffles, lead campaigns, market research both online and offline, specialist webportals and e-learning offers. In case my personal telephone number has also been collected, it may be used for offers of aforementioned products, for services of the companies mentioned above, and market research purposes.

Additionally, my consent also includes the processing of my email address and telephone number for data matching for marketing purposes with select advertising partners such as LinkedIn, Google, and Meta. For this, Vogel Communications Group may transmit said data in hashed form to the advertising partners who then use said data to determine whether I am also a member of the mentioned advertising partner portals. Vogel Communications Group uses this feature for the purposes of re-targeting (up-selling, cross-selling, and customer loyalty), generating so-called look-alike audiences for acquisition of new customers, and as basis for exclusion for on-going advertising campaigns. Further information can be found in section “data matching for marketing purposes”.

In case I access protected data on Internet portals of Vogel Communications Group including any affiliated companies according to §§ 15 et seq. AktG, I need to provide further data in order to register for the access to such content. In return for this free access to editorial content, my data may be used in accordance with this consent for the purposes stated here. This does not apply to data matching for marketing purposes.

Right of revocation

I understand that I can revoke my consent at will. My revocation does not change the lawfulness of data processing that was conducted based on my consent leading up to my revocation. One option to declare my revocation is to use the contact form found at https://contact.vogel.de. In case I no longer wish to receive certain newsletters, I have subscribed to, I can also click on the unsubscribe link included at the end of a newsletter. Further information regarding my right of revocation and the implementation of it as well as the consequences of my revocation can be found in the data protection declaration, section editorial newsletter.

Cybersecurity front