The Process and Risks of Introducing NIS2 in Hungary

Abstract

The number and complexity of incidents and attacks in cyberspace increased significantly after the turn of the millennium and caused significant damage not only to the private sector, but also to governments. These events made it clear that it is necessary to create a comprehensive cyber security regulation in the EU. In 2016, the Union adopted its first EU-level cybersecurity legislation, the Network and Information Security (NIS) Directive, which was a fundamental step towards the common information security of EU-level network and information systems. During the implementation, the stakeholders faced several challenges both at the EU and national level, and due to the rapid development of cyber threats and the rapid spread of new technologies, the directive - due to its nature - was unable to keep up with the continuous changes.
The emerging challenges and the constantly changing digital environment forced a review of the EU framework. As a result, NIS2 was born. The updated directive represents a comprehensive strategy in the field of EU cyber security, its declared aim is to strengthen enforcement mechanisms, the basic legal pillar of the field. At the same time, it significantly expanded the subject and material scope of its predecessor, the NIS, in order to strengthen the resilience of critical infrastructures and services.

The purpose of this study is to investigate whether the conditions are available for the compliance of domestic enterprises and organizations covered by the directive, and what is necessary for the relevant organizations to be able to meet the expectations of NIS2