The European Parliament gave final approval to the Network and Information Security Directive (“Directive”), the first-ever EU-wide cybersecurity standards, on July 6, 2016. The Directive seeks to improve the cybersecurity capabilities of member states, as well as improve cooperation on cybersecurity issues between EU nations. The new rules require “operators of essential services” and some internet services providers to adhere to minimum cybersecurity standards and report significant cyber-attacks to public authorities. The Directive puts an end to the fragmentation of individual cybersecurity systems currently in place in the twenty-eight member states, and substantially changes the cybersecurity regulatory landscape for many businesses that operate within the EU.

Data, Privacy & Security in the EU -

The Directive is an outgrowth of the European Commission’s 2013 Cybersecurity Strategy and proposed Directive on Network and Information Security. Although European authorities moved relatively quickly since reaching a provisional agreement on the new cybersecurity regime in December 2015, the law making process of the Directive took over three years.