On July 6, 2016 the European Parliament adopted the EU’s first legislation on cybersecurity: the Network and Information Security (NIS) Directive. The objective of the Directive is to achieve a high common level of security of network and information systems within the EU, by means of:
Improved cybersecurity capabilities at national level
Increased EU-level cooperation
Risk management and incident reporting obligations for operators of essential services and digital service providers
In his Welcoming statement, Vice-President for the Digital Single Market on the European Commission Andrus Ansip said: "If we want people and businesses to make the most of digital services, they need to trust them. A Digital Single Market can only be created in a secure online environment. The Directive on Security of Network and Information Systems is the first comprehensive piece of EU legislation on cybersecurity and a fundamental building block for our work in this area. It requires companies in critical sectors – such as energy, transport, banking and health – to adopt risk management practices and report major incidents that can affect the Digital Single Market to their national authorities which will, in turn, be able to carry out better capacity-building with greater cross-border cooperation inside the EU. It also obliges online market places, cloud computing services and search engines to take similar security steps."
[Statement by Vice-President Ansip and Commissioner Oettinger welcoming the adoption of the first EU-wide rules on cybersecurity]
Following its publication in the EU Official Journal (probably in August 2016), EU member states will have 21 months to transpose the directive into their national laws. The NIS Directive will therefore likely apply from May 2018.
Find more details on the NIS Directive here.