NIS2
A short overview for small and medium Icelandic businesses. Every statement about the law points to a source and a date.
What NIS2 is
NIS2 is Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union.Source: eur-lex.europa.eu,
Article 21 lists the minimum risk-management measures, among them incident handling, business continuity and backups, supply chain security, cryptography and multi-factor authentication.Source: eur-lex.europa.eu,
EU member states had to transpose the directive by 17 October 2024 and apply the rules from 18 October 2024 (Article 41).Source: eur-lex.europa.eu,
A significant incident must be reported with an early warning within 24 hours, a notification within 72 hours and a final report within one month (Article 23).Source: eur-lex.europa.eu,
Why EU customers ask
Companies in the EU that fall under NIS2 have to look at the security of their direct suppliers. That is one reason they send suppliers, Icelandic ones included, security questionnaires.Source: eur-lex.europa.eu,
The situation in Iceland
NIS2 has not been incorporated into the EEA Agreement. Iceland, Liechtenstein and Norway are still assessing it for incorporation.Source: www.efta.int,
What a passive check can show
Netskor is a passive, external check of a company's domain. It needs nothing but the domain name.
A passive check can show part of the technical side, such as email authentication, HTTPS and DNSSEC. That touches basic cyber hygiene, cryptography and secured communications (Article 21(2)(g), (h) and (j)).
It cannot show policies, incident response, backups, training, access control or anything else that is not visible from outside.
This page is for guidance only and is not legal advice.