NIS2

NIS2 is the EU directive (EU) 2022/2555 that sets cybersecurity risk-management, training and incident-reporting obligations for essential and important entities across critical sectors. In Germany, Section 30 BSIG makes security awareness training a statutory duty for important and particularly important entities, and the CLOUD Act and the Schrems II ruling make US-hosted training data a compliance risk.