{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/nis1","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/nis1/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/nis1/"},"term":{"en":"NIS1 Directive","da":"NIS1-direktivet"},"aka":{"en":["NIS1","NIS Directive","Directive (EU) 2016/1148"],"da":["NIS1","NIS-direktivet"]},"domain":["security"],"cluster":"compliance","layer":"governance","status":"legacy","era":2016,"summary":{"en":"The first EU-wide cybersecurity law, from 2016, which set security and reporting duties for key service providers until NIS2 replaced it.","da":"EU's første fælles cybersikkerhedslov fra 2016, der stillede krav om sikkerhed og indberetning til vitale tjenester, til NIS2 afløste den."},"body":{"formal":{"en":"Directive (EU) 2016/1148, written into each member state's own law by May 2018, covering operators of essential services in sectors such as energy, transport, banking, health and drinking water, plus online marketplaces, search engines and cloud services.","da":"Direktiv (EU) 2016/1148, som hvert medlemsland skulle skrive ind i sin egen lovgivning senest maj 2018, og som dækkede operatører af væsentlige tjenester inden for fx energi, transport, bank, sundhed og drikkevand samt online markedspladser, søgemaskiner og cloudtjenester."},"plain":{"en":"Like the first edition of a book of rules - it set the idea that firms society leans on must guard their systems, but left each country free to decide who had to follow it.","da":"Som første udgave af en regelbog - den slog fast, at de virksomheder, samfundet læner sig op ad, skal passe på deres systemer, men lod hvert land selv bestemme, hvem der skulle følge den."},"inPractice":{"en":"In 2018 a Danish energy company was named an operator of essential services, so it had to take suitable security measures and report incidents that seriously disrupted its supply to the national authority.","da":"I 2018 blev et dansk energiselskab udpeget som operatør af en væsentlig tjeneste og skulle derfor træffe passende sikkerhedstiltag og indberette hændelser, der alvorligt forstyrrede forsyningen, til den nationale myndighed."},"whyItMatters":{"en":"It was the first time the EU made cyber risk a legal duty across borders; because countries drew the lines so differently, it was repealed and replaced by NIS2 from 18 October 2024.","da":"Det var første gang, EU gjorde cyberrisiko til en juridisk pligt på tværs af grænser; fordi landene trak grænserne så forskelligt, blev det ophævet og afløst af NIS2 fra 18. oktober 2024."}},"deepDive":{"en":"Directive (EU) 2016/1148 was adopted on 6 July 2016 with a transposition deadline of 9 May 2018, and member states then had until 9 November 2018 to identify their operators of essential services (OES). Identification was the heart of the design and also its weakness. Under Article 5(2) an entity was an OES if it provided a service essential for critical societal or economic activities, the service depended on network and information systems, and an incident would have significant disruptive effects; Article 6 listed factors for judging that effect, such as the number of users relying on the service, dependency of other sectors, market share and geographic spread. Each country applied these criteria itself, so comparable companies were in scope in one state and outside it in the next.\n\nThe directive had two tiers of obligations. OES in the Annex II sectors (energy, transport, banking, financial market infrastructures, health, drinking water supply and digital infrastructure) had to take appropriate and proportionate security measures and notify significant incidents to the competent authority or CSIRT without undue delay (Article 14). Digital service providers (online marketplaces, online search engines and cloud computing services) faced a lighter regime under Article 16, were supervised only after the fact (Article 17), came under the jurisdiction of the member state of their main establishment (Article 18), and micro and small enterprises were exempt. Commission Implementing Regulation (EU) 2018/151 specified the security elements and incident parameters for them.\n\nBeyond duties for companies, NIS1 built the institutional layer that NIS2 later inherited: national strategies (Article 7), competent authorities and single points of contact (Article 8), national CSIRTs (Article 9), the Cooperation Group of member states (Article 11) and the network of CSIRTs (Article 12). Penalties were left to national law, which only had to make them effective, proportionate and dissuasive (Article 21), and amounts varied widely. Public administration was not covered, and there was no explicit duty for management bodies.\n\nThe Commission's review found fragmented scope, uneven supervision and weak enforcement, which led to NIS2: a uniform size-cap rule instead of national identification, 18 sectors instead of seven plus three digital services, staged reporting deadlines, harmonised fine maxima and personal accountability for management. NIS2 Article 44 repealed NIS1 with effect from 18 October 2024. In Denmark NIS1 had been implemented through several sector-specific acts rather than one horizontal law, a split that partly survives in the separate Danish rules for energy, telecommunications and finance under NIS2.","da":"Direktiv (EU) 2016/1148 blev vedtaget den 6. juli 2016 med frist for gennemførelse den 9. maj 2018, og medlemsstaterne havde derefter til den 9. november 2018 til at udpege deres operatører af væsentlige tjenester. Udpegningen var kernen i konstruktionen og samtidig dens svaghed. Efter artikel 5, stk. 2, var en enhed operatør af en væsentlig tjeneste, hvis den leverede en tjeneste, der var afgørende for kritiske samfundsmæssige eller økonomiske aktiviteter, tjenesten var afhængig af net- og informationssystemer, og en hændelse ville have væsentlige forstyrrende virkninger; artikel 6 nævnte faktorer til at vurdere virkningen, fx antallet af brugere, der er afhængige af tjenesten, andre sektorers afhængighed, markedsandel og geografisk udbredelse. Hvert land anvendte selv kriterierne, så sammenlignelige virksomheder kunne være omfattet i ét land og ikke i nabolandet.\n\nDirektivet havde to niveauer af forpligtelser. Operatører i sektorerne i bilag II (energi, transport, bankvirksomhed, finansielle markedsinfrastrukturer, sundhed, drikkevandsforsyning og digital infrastruktur) skulle træffe passende og forholdsmæssige sikkerhedsforanstaltninger og underrette den kompetente myndighed eller CSIRT'en om væsentlige hændelser uden unødig forsinkelse (artikel 14). Udbydere af digitale tjenester (online markedspladser, online søgemaskiner og cloud computing-tjenester) var underlagt en lettere ordning efter artikel 16, blev kun kontrolleret efterfølgende (artikel 17), hørte under jurisdiktionen i det land, hvor de havde deres hovedforretningssted (artikel 18), og mikro- og små virksomheder var undtaget. Kommissionens gennemførelsesforordning (EU) 2018/151 præciserede sikkerhedselementerne og hændelsesparametrene for dem.\n\nUd over pligterne for virksomheder opbyggede NIS1 det institutionelle lag, som NIS2 senere overtog: nationale strategier (artikel 7), kompetente myndigheder og centrale kontaktpunkter (artikel 8), nationale CSIRT'er (artikel 9), medlemsstaternes samarbejdsgruppe (artikel 11) og netværket af CSIRT'er (artikel 12). Sanktionerne blev overladt til national ret, som blot skulle gøre dem effektive, forholdsmæssige og afskrækkende (artikel 21), og niveauerne varierede meget. Den offentlige forvaltning var ikke omfattet, og der var ingen udtrykkelig pligt for ledelsesorganet.\n\nKommissionens evaluering pegede på et fragmenteret anvendelsesområde, ujævnt tilsyn og svag håndhævelse, hvilket førte til NIS2: en ensartet størrelsesregel i stedet for national udpegning, 18 sektorer i stedet for syv plus tre digitale tjenester, trinvise indberetningsfrister, harmoniserede bødemaksimum og personligt ansvar for ledelsen. NIS2 artikel 44 ophævede NIS1 med virkning fra den 18. oktober 2024. I Danmark blev NIS1 gennemført gennem flere sektorlove frem for én tværgående lov, en opdeling, der delvist lever videre i de særskilte danske regler for energi, tele og finans under NIS2."},"edges":[{"type":"requires","to":"security/cyber-and-information-security","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/eu-directive","confidence":"high","strength":"normal"},{"type":"mandates","to":"security/risk-management","why":{"en":"Covered organisations had to take measures suited to the risks facing the systems behind their services.","da":"De organisationer, loven dækkede, skulle træffe tiltag, der passede til risiciene for de systemer, som deres tjenester byggede på."},"confidence":"high","strength":"primary"},{"type":"mandates","to":"security/incident-reporting","why":{"en":"Incidents with a significant impact on the service had to be reported to the national authority without undue delay.","da":"Hændelser med betydelig indvirkning på tjenesten skulle indberettes til den nationale myndighed uden unødig forsinkelse."},"confidence":"high","strength":"primary"}],"depth":1,"sources":[{"title":"Directive (EU) 2016/1148 (NIS Directive)","url":"https://eur-lex.europa.eu/eli/dir/2016/1148/oj","tier":"standard","publisher":"European Union"}],"draft":true}