Période de consultation publique et avis pour le règlement d’exécution établissant les règles d’application de la directive (UE) 2022/2555 (directive NIS2) en ce qui concerne les exigences techniques et méthodologiques des mesures de gestion des risques en matière de cybersécurité et la précision des cas dans lesquels un incident est considéré comme étant important (uniquement en anglais)

The CSSF would like to inform the public that in the context of the implementation of the NIS2 Directive, the European Commission has recently published a Draft Implementing Regulation as well as the related Annex laying down the technical and the methodological requirements of cybersecurity risk management measures referred to in Article 21(2) of the NIS2 Directive and to further specify the cases in which an incident shall be considered to be significant as referred to in Article 23(3) of the NIS2 Directive for public consultation and feedback until 25 July 2024.

Support PSF that are providing trust services (as defined in Article 3, point (16), of Regulation (EU) No 910/2014 are in scope of NIS2.

As the transposition in national law of the NIS2 Directive is still ongoing, the identification of other Support PFS which will be in scope of the Directive as essential or important entities is in progress.

However, due to their activities in the Digital Infrastructure sector (cloud computing service providers, data centre service providers) and/or ICT service management sector (managed service providers and managed security service providers), a large number of Support PFS authorised as IT systems and communication networks operators of the financial sector pursuant to Article 29-3 of the Law of 5 April 1993 on the financial sector are also likely to fall under the NIS2 Directive as essential or important entities.

Therefore, the CSSF invites all the above-mentioned types of Support PFS  to take note of this text and, if they are interested, to submit their potential feedback to the European Commission directly through the website provided for this purpose.

The Public Consultation and Feedback of the Implementing Regulation is available by following the link below:
https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/14241-Cybersecurity-risk-management-reporting-obligations-for-digital-infrastructure-providers-and-ICT-service-managers_en