Loading story…
The NIS2 Directive has introduced new, binding cybersecurity requirements for organizations across the European Union, emphasizing that cybersecurity is a core business risk requiring executive-level oversight. The directive mandates enhanced risk management, supply chain security, incident response, and reporting measures, as well as increased management accountability. In Spain, NIS2 became binding in January, prompting organizations to adopt modern security technologies and integrate comprehensive strategies to protect sensitive data and ensure regulatory compliance. Industry leaders highlight the need for systematic approaches to compliance and stress that IT risks must be managed as business risks under the new regulatory landscape.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
The Finnish Transport and Communications Agency awarded €1.65 million to 35 applicants to help small and medium-sized organizations covered by the Cybersecurity Act improve cybersecurity and risk management. The grants support 2026 projects aimed at meeting statutory requirements for essential and important communication networks and information systems.
France’s cybersecurity agency ANSSI opened a pre-registration portal to support organizations preparing for NIS2 compliance and identification under the national implementation process. The move marked a new operational step in France’s rollout of NIS2 obligations.
Initial story creation
Traficom’s Cyber Security Centre said implementation of Finland’s Cybersecurity Act was underway and that incident notifications under the new NIS2-based reporting obligations had started well after the law took effect in early April. It urged covered organizations to register in the operator register by 2025-05-08 and announced a 2025-05-12 webinar on implementation and supervision.
Finland's Parliament approved the Cybersecurity Act implementing NIS2 Directive obligations, and the new requirements took effect on 2025-04-08. The law introduced new risk management and incident reporting obligations across multiple sectors, with affected entities required to register in the operator registry.
Traficom announced it was preparing a recommendation to support implementation of the NIS2 Directive’s cybersecurity risk management measures in Finland. The guidance was intended to help supervisory authorities and covered sectors interpret baseline obligations during national legislative drafting.
The European Commission published proposal 52022PC0454 on 2022-10-21, setting out EU-wide horizontal cybersecurity requirements for products with digital elements. The proposal marked an earlier policy development in the broader regulatory story preceding Finland’s later national implementation measures.
18 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourcecio.com
Open sourcekyberturvallisuuskeskus.fi
Open sourcezdnet.fr
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceeur-lex.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
European organizations are facing significant challenges in implementing the NIS2 Directive, with many CISOs reporting that compliance efforts are being hampered by excessive documentation requirements and unclear regulatory expectations. The process often results in a heavy administrative burden, where compliance is measured by the ability to produce extensive paperwork rather than demonstrable improvements in actual security posture. This disconnect between regulatory intent and practical outcomes has led to concerns that the focus on documentation may not translate into meaningful risk reduction. A recent study highlights that NIS2 is projected to reach around 70% adoption by the end of 2025, which is lower than other frameworks such as HIPAA and GDPR but higher than PCI DSS. The study attributes this to the stronger enforcement mechanisms of NIS2, which, like GDPR and HIPAA, relies on public authorities for oversight and sanctions, as opposed to the contractual enforcement model of PCI DSS. The comparison underscores the importance of independent regulatory oversight in driving compliance and suggests that while NIS2's adoption is progressing, the effectiveness of its implementation remains a concern due to the administrative complexities involved.
Jun 29, 2026
The European Commission has referred **France, Ireland, Spain and the Netherlands** to the Court of Justice of the European Union for failing to transpose the `NIS2` Directive into national law more than 20 months after the deadline. Brussels is seeking both lump-sum and daily financial penalties until each country formally notifies full implementation of the cybersecurity law, which expands security and incident-reporting obligations across **18 critical sectors** and sits at the center of the EU’s wider cyber regulatory framework. In France, the enforcement action follows another delay in parliamentary review of the national transposition bill, with examination now expected in September rather than July despite the measure being treated as a government priority. The French debate has also been complicated by a disputed provision, **article 16 bis**, which would protect end-to-end encryption and has drawn criticism from the parliamentary intelligence delegation over concerns it could restrict access to protected data, while **ANSSI** continues operational preparations through preregistration work and a new agreement with the Banque de France and the **ACPR**.
Jul 9, 2026
European and UK regulatory pressure is pushing cybersecurity from an IT function into **board-level accountability**, with frameworks like **NIS2** and UK cyber resilience policy expectations emphasizing management oversight and demonstrable cyber-risk governance. Reporting focused on operational metrics (e.g., patch counts, vulnerability totals, tool deployment) is increasingly viewed as insufficient for executives because it does not show whether enterprise risk exposure is trending up or down; guidance and industry outlooks highlight the need for measurable, business-aligned KPIs that support defensible oversight and investment decisions. Cloud environments amplify this governance challenge because **unknown or unmanaged assets** (shadow accounts, orphaned identities, forgotten data stores, and third-party integrations) can sit outside monitoring, IAM governance, and incident response processes, creating “invisible” attack surface and compliance exposure. A commonly cited failure pattern is data exposure from an abandoned or untracked cloud subscription where no sophisticated exploit is required—risk materializes because the organization cannot inventory what it owns—reinforcing that real-time asset discovery and visibility are prerequisites for credible cloud security and board reporting.
Jul 12, 2026