Public sector — NIS2: securing public services

What does NIS2 cover?

NIS2 includes public administration among the entities to be secured, leaving member states some discretion over scope (particularly at the local level). France incorporates a large number of public bodies.

The measures under Article 21 apply to information systems supporting public services.

Is the 'Public sector' concerned?

Central administrations, operators and public bodies fall within scope depending on the transposition. The local level is covered on the 'Local Authority' page.

Public software vendors and service providers are indirectly concerned, through supply chain security requirements.

Detailed obligations

Sanctions & risks

The sanctions regime depends on transposition; the primary concern remains continuity and public trust in public services. Ransomware attacks targeting government agencies are frequent and costly.

Application timeline

• 1Directive. Adopted end of 2022.
• 2France. Transposition in progress; public-sector scope to be confirmed.

Common mistakes in the sector

• 1Neglected continuity. Failing to prepare for ransomware recovery.
• 2Unsecured chain. Leaving public software publishers ungoverned.
• 3Untested backups. Have backups that have never been tested.
• 4Absent leadership. Limiting security to technical measures.

Practical case

A public authority suffers a ransomware attack disrupting its online services. The NIS2 approach involves rolling out multi-factor authentication, regularly testing backups and recovery procedures, governing service providers, and formalising incident notification.

Compliance roadmap

1. 1

   Qualify. Determining inclusion in scope.

2. 2

   Analyse. Current status with regard to Article 21.

3. 3

   Secure. Measures and continuity plan.

4. 4

   Frame. Securing service providers and vendors.

5. 5

   Notify. Equip alerting and reporting.

Frequently asked questions