NIS2 Compliance

Space is a sector in NIS2 Annex I (No. 11: operators of ground-based infrastructure that supports space-based services). Entities of that type that exceed the EU ceilings for medium-sized enterprises (250 or more staff, or annual turnover above EUR 50M and balance sheet above EUR 43M; Recommendation 2003/361/EC) are essential (Art. 3(1)(a)); medium-sized ones are important (Art. 3(2)). Small and micro entities are outside NIS2 (Art. 2(1)) unless a size-independent case of Art. 2(2) applies, for example identification by a Member State. National transposition laws decide the details.

Article 21(2) requires at least: (a) policies on risk analysis and information system security; (b) incident handling; (c) business continuity, backup management, disaster recovery and crisis management; (d) supply chain security; (e) security in acquisition, development and maintenance, including vulnerability handling and disclosure; (f) procedures to assess the effectiveness of the measures; (g) basic cyber hygiene and cybersecurity training; (h) cryptography and, where appropriate, encryption; (i) human resources security, access control and asset management; (j) multi-factor or continuous authentication and secured communications, where appropriate.

For infringements of Art. 21 or 23, Member States must provide fines with a maximum of at least EUR 10M or 2% of total worldwide annual turnover, whichever is higher, for essential entities and at least EUR 7M or 1.4% for important entities (Art. 34(4)-(5)). Other supervisory and enforcement measures follow from Art. 32-33; penalties for other infringements are set nationally (Art. 36).