Study to support the review of Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (NIS Directive), No. 2020- 665 : executive summary

ICF, Wavestone and CEPS were awarded the contract to carry out the study to support the review of Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (NIS Directive) - N° 2020-665. This study followed the Better Regulation Guidelines and was distributed in four main tasks. Under Task 1 a retrospective evaluation of the functioning of the legal framework in its current shape was carried out elaborating on the lessons learned from the implementation of the NIS Directive in the Member States while identifying persisting and emerging issues. Task 2 was dedicated to the identification of both novel policy concepts and measures including concrete new regulatory elements not addressed in the current NIS Directive, but which could contribute to increasing the level of cybersecurity in Europe in the future. Task 3 provided a forward-looking input to support the impact assessment process, in which the positive and negative impacts of several possible measures and policy options were assessed. Finally, under Task 4 a comprehensive stakeholder dialogue was implemented (i.e. National Competent Authorities (CAs), Single Points of Contact (SPOCs), Computer Security Incident Response Teams (CSIRTs), Operators of Essential Services (OESs) and Digital Services Providers (DSPs)) feeding into the study and into the wider impact assessment process carried out by the European Commission. The study provided an evidence-based judgement to inform the Commission on future decisions relating to the security of networks and information systems across the European Union, and notably the review of the NIS Directive.