Local authority — NIS2: securing services with limited resources

What does NIS2 cover?

NIS2 leaves member states some discretion regarding the inclusion of local entities. Regardless of their classification, local authorities are highly exposed to ransomware, with a direct impact on residents (civil registration, public services).

The measures under Article 21 provide a useful security baseline even outside the strict scope.

Is the 'Local Authority' sector affected?

Entities in scope under the transposition and by size must apply the measures; others have every reason to draw inspiration from them.

Pooling resources (shared CISO, shared tools) is often the only realistic path.

Detailed obligations

Sanctions & risks

The regime depends on transposition; the impact of ransomware on end users is immediate and highly visible, making security a local political issue.

Application timeline

• 1Directive. Adopted end of 2022.
• 2France. Transposition in progress; scope for local authorities to be confirmed.

Common mistakes in the sector

• 1Untested backups. Have backups that have never been tested.
• 2MFA absent. Failing to roll out multi-factor authentication universally.
• 3Unmanaged service providers. Leaving business software vendors without requirements.
• 4No pooling. Remain isolated in the face of limited resources.

Practical case

A municipality is hit by ransomware that disrupts civil registration services. Without tested backups, recovery takes a long time. The NIS2 approach involves rolling out MFA and tested backups organisation-wide, preparing for business continuity, and sharing a CISO with the inter-municipal authority.

Compliance roadmap

1. 1

   Qualify. Determine inclusion based on transposition status and size.

2. 2

   Secure. Deploy priority measures (MFA, backups).

3. 3

   Continuity. Preparing the recovery of essential services.

4. 4

   Pool resources. Share resources.

5. 5

   Notify. Tool up alerting.

Frequently asked questions