📋 Tender Overview
The Office of the Government of the Republic of Slovenia for Information Security (URSIV) is preparing a new Act on Information Security (ZInfV-1), which will, among other things, transpose into Slovenian legislation the European Directive on measures for a high common level of cyber security in the Union, also known as the NIS 2 directive, which was adopted in December 2022, and EU member states are expected to transpose it into their legal order by October 17, 2024.
The NIS 2 Directive represents pan-European legislation on cyber security and sets out legal measures to increase the overall level of cyber resilience in the EU. The main objective of the directive is to update the legal framework to keep up with the increasing digitization and new cyber security threats. By extending cyber security rules to new areas and entities, the directive further improves resilience and the ability to respond to cyber incidents. In doing so, it will contribute to greater cyber security of companies, member states and the EU as a whole.
The scope of the NIS 2 directive is significantly wider than the existing legislation. It brings many changes for entities that are already liable under the existing Information Security Act (ZInfV) and must protect their information systems accordingly. The news is also promising for a large number of other entities that will be covered by the new regulation and so far were not obliged to fulfill any obligations and reported incidents on a voluntary basis.
Do the critical sectors remain the same as under the existing law?
An important innovation is that the directive redefines critical sectors, which are not the same as in the existing ZInfV. The sectors are now divided into two groups.
The first group is represented by highly critical sectors :
energy (electricity, district heating and cooling, oil, natural gas, hydrogen),
transport (air, rail, water, road),
banking,
infrastructure of financial markets,
health (it no longer includes only hospitals, but also reference laboratories, manufacturers of medical devices or pharmaceutical preparations and others),
drinking water,
Waste water,
digital infrastructure,
management of information communication technology (ICT) services,
public administration (central and regional) and
space.
The second group is the rest of the critical sectors:
postal and courier services,
waste management,
manufacture, production and distribution of chemicals,
production, processing and distribution of foodstuffs,
digital providers,
research and
production:
medical devices and in vitro diagnostic medical devices,
computers, electronic and optical products,
electrical appliances,
other machines and devices,
motor vehicles, trailers and semi-trailers,
other vehicles and vessels.
Who will designate the company or state authority as liable under the law?
The new arrangement will no longer necessarily be linked to the prior identification of the company as a taxpayer by the competent national authorities. If the company belongs to the category of large or medium-sized company (more than 50 employees and annual turnover of more than ten million euros) and operates in one of the defined highly critical or critical sectors, it will automatically fall under the obligations of the directive . There are exceptions to this when entities are bound regardless of size.
Taxpayers will now have to self-register . They will also be divided into essential and important entities , which will replace the old distinction between providers of essential services and providers of digital services. The difference between essential and important entities will be mainly in control and sanctions.
Essential and important entities will, among other things, have to take appropriate and proportionate measures to manage the risks to the security of their networks and information systems and to prevent incidents or mitigate the consequences of incidents for the recipients of their services and for other services. At the same time, they will have to report any significant incident without delay . At the same time, the NIS 2 directive defines notification procedures and obliges entities to notify the recipients of their services.
What does self-registration mean?
Self-registration is an important innovation for Slovenian entities. Every taxpayer will have to self-identify or self-register through a self-registration mechanism, which will be established for this purpose by URSIV as the competent national authority.
URSIV will therefore only establish a list of essential and important entities and entities that provide domain name registration services based on the information obtained from self-registered taxpayers.
When entering data into the self-registration mechanism, the potential obligee will determine whether he is an obligee as well as whether he is an essential or important entity.
How will the control over the implementation of the law be carried out?
The NIS 2 directive expands the scope of application, strengthens the security requirements for obliged entities and introduces more precise provisions on the procedure for reporting incidents, the content of reports and deadlines for their submission. It also establishes stricter control measures, enhanced supply chain security, and establishes a basic framework for coordinated vulnerability disclosure.
The NIS 2 Directive envisages that competent national authorities should also have powers to take action to encourage entities to take appropriate measures. This can range from issuing warnings or binding instructions to remedy deficiencies to informing their customers . In addition to these administrative measures, effective, proportionate and dissuasive administrative fines may also be imposed .
