Following nearly two years of negotiations, the European Parliament and European Council finally reached agreement on the Network and Information Security Directive (“NIS Directive”) in December 2015.1 The Directive will require certain operators of “essential services” and “digital services providers” (e.g., online marketplaces, search engines and cloud computing services) to implement cybersecurity controls and report significant security breaches to the appropriate national authority. EU member states will be required to implement the NIS Directive at the national level within 21 months and will have an additional six months to identify in-scope entities. It is therefore possible that we will not see the real-world impacts of the Directive until 2017 or 2018. The fact that the imposition of minimum cybersecurity requirements on critical infrastructure owners is still merely on the horizon has not, however, prevented EU member states from moving ahead with legislation of their own in the meantime.

While discussions on the NIS Directive were ongoing, Germany passed its own domestic cybersecurity law in 2015 aimed at safeguarding IT systems in companies essential to national interests. The “Act to Increase the Security of Information Technology Systems” (Gesetz zur Erhöhung der Sicherheit informationstechnischer Systeme (text in German)) (referred to as the “IT Security Act”) is Germany’s first comprehensive legislative scheme passed for the purpose of establishing a minimum level of cybersecurity in critical infrastructure, as defined by the law.