Does the NIS2 cybersecurity law apply to my company?

To medium and large entities in the sectors listed in the national NIS2 law (in Croatia the Cybersecurity Act, NN 14/2024): energy, transport, health, water, digital infrastructure, finance, food, manufacturing and others, and to some regardless of size. We are reading the categorisation and measure deadlines from the law and the regulation; this card is being checked.

Who must?

Entities in the sectors in the annexes of the law, as a rule from 50 employees or 10 million € turnover, and their key suppliers if the authority categorises them so.

What to do?

1. Check whether you are in a sector from the annexes.
2. If you are, wait for or request categorisation from the competent authority.
3. Implement the measures from the cybersecurity regulation and report incidents.

Where to file?

The national CSIRT for incidents; categorisation is done by the competent authority.

Who checks?

Competent authority by sector (in Croatia: SOA, CARNET, HNB and others)

Fine

We are checking the fine in the source; until then we do not write a number.

What if I am already late?

Contact the competent authority for your sector and start with the basic measures (access, backups, patches).