Topical Article

NIS 2 Directive | What it means for healthcare, pharma, and manufacturers of medical devices

Posted on by Congenius

On 27 December 2022, Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the EU (NIS 2 Directive) was published in the Official Journal of the European Union. Entering into force earlier this week on the 16 January, the Directive will apply from 18 October 2024. Below, our Head of eHealth Paul Gardner summarises the implications of NIS 2 and offers some advice on complying with the Directive.

NIS 2 Directive – Who needs to comply and what are the obligations?

NIS 2 replaces the current NIS Directive (Directive (EU) 2016/1148), setting out a regulatory framework for cybersecurity. All medium and large organisations operating within the sectors covered by the Directive, or those which provide services covered in the Directive fall within its scope. This includes healthcare providers, pharmaceutical companies, and manufacturers of medical devices considered critical in a public health emergency.

Appropriate & proportionate risk management measures

For qualifying organisations, NIS 2 mandates that management must approve the cybersecurity risk-management measures taken by their organisation, and that members of the management must follow specific training before subsequently providing training to their employees.

According to Article 21 in the Directive (Cybersecurity risk-management measures), organisations must take appropriate and proportionate technical, operational, and organisational measures to:

  • manage the security risks posed to their network and information systems used for operations or service provision
  • prevent or minimise the impact of incidents on recipients of their services and on other services

The measures should ensure a level of security that’s appropriate to the risks posed – taking into consideration the “state-of-the-art”, relevant European and international standards, and the cost of implementation. During the proportionality assessment of the measures to take, organisations should weigh up their size, their exposure to risks, and the likelihood and potential severity of incidents – including any societal and economic impact.

An “all-hazards approach”

Organisations are advised to ensure that the measures they take are based on an “all-hazards approach” that aims to protect their network and information systems and the physical environment of those systems from security incidents. The measures should cover the following as a minimum:

  • The creation of policies regarding risk analysis and information system security, effectiveness assessment of cybersecurity risk-management measures, and the use of cryptography (and where appropriate, encryption)
  • Incident handling
  • Business continuity
  • Supply chain security
  • Security in network and information systems acquisition, development, and maintenance, including vulnerability handling and disclosure
  • Basic cyber hygiene practices and cybersecurity training
  • Human resources security, access control policies and asset management
  • The use of multi-factor authentication / continuous authentication solutions, secured voice, video and text communications and secured emergency communication systems, where appropriate

Advice for complying with the NIS 2 Directive

The NIS regulations reference that companies should consider compliance with international standards, and the guidance issued by the European Union Agency for Cybersecurity (ENISA) maps security objectives to several best practice standards.

Attaining ISO 27001 certification for information security management systems is the logical first step to achieving compliance with the NIS 2 Directive. An ISO 27001- compliant information security management system (ISMS) enables an organisation to reduce its risk and exposure to security threats by identifying the relevant policies that need to be documented, the technologies required to protect itself, and the staff training necessary to avoid issues. An ISMS also mandates that the organisation conducts annual risk assessments, which are helpful for staying ahead of the ever-changing risk landscape.

ISO 27001 will help your organisation to meet the NIS 2 requirements whilst also facilitating independently audited certification. This provides evidence to suppliers, stakeholders, and regulators that you’ve taken the appropriate and proportionate technical and organisational measures required –providing you with a competitive edge in the marketplace.

Any organisations looking to take further measures to demonstrate compliance with NIS 2 could consider the additional certification of ISO 22301 for business continuity management. ISO 22301 is structured to help you implement, maintain, and continuously improve your approach to business continuity. Whilst ISO 27001 includes business continuity management (BCM), it doesn’t define a specific process for BCM implementation. As such, ISO 22301 complements ISO 27001 with its inclusion of this process.

In short, the combination of ISO 27001 and ISO 22301 certification enables the creation of a compliant and effective integrated management system comprising of both an ISMS and a BCMS – ultimately empowering your organisation to continuously limit risk and exposure to security threats.

Should you require further advice regarding the NIS 2 Directive, or guidance on cybersecurity more generally, feel free to get in touch with our eHealth experts. 

Related News & Knowledge


Get in touch

If you have a challenge that you think we could help with, please feel free to get in touch by filling out our contact form or by giving us a call. We look forward to speaking with you!

Congenius AG
Riedstrasse 1
CH-8953 Dietikon

e: [email protected]
t: +41 44 741 04 04


    a demo

    Find out more about QMgeniuS by requesting a demo.

    Simply fill out your details and click “Request a demo", then a member of the team will get back to you shortly.

    Alternatively, feel free to give us a call on +41 44 741 04 04 to start the conversation. We look forward to hearing from you!


      Subscribe to our
      monthly knowledge update

      Stay informed and up to date with the latest industry news delivered direct to your inbox. You can tailor your preferences to prioritise what you'd like to hear about each month; be it MedTech news headlines, fact sheet resources on the latest regulations or longer articles covering timely topics across the wider MedTech industry.

      By clicking subscribe, you are signing up to receive a monthly newsletter from us containing MedTech news, industry insights and more from Congenius. Subscribing also gives you full access to all topical content on our website. For information on how your data is managed, see our privacy policy.