A Systematic Literature Review on the NIS2 Directive

Europe, like all regions in the world, is facing an ever-increasing trend of digitalization. With increasing digitalization comes also increasing cyber security risks. At the same time, geopolitical conflicts and tensions have emerged throughout the world, and technological development progresses rapidly. These and other “mega-trends” affect cyber security too. Given this state of affairs, the EU has recently adopted many new cyber security regulations. Among these is the NIS2 directive. It repeals an older 2016 directive that addressed the cyber security of network and information systems (NIS). The older directive was an important historical part in the evolution of the EU’s overall cyber security framework. In terms of public sector administration and governance, it was built upon national computer security incident response teams (CSIRTs), which too are an important part of the global evolution of cyber security governance (Skopik et al.,, 2016). The new NIS2 directive builds upon this evolutionary trajectory, further strengthening CSIRTs and their coordination with private sector actors.

Coordination is important because many—if not the most—of the Europe’s critical infrastructures are either owned or operated by private sector entities. The NIS2 directive categorizes these entities into two groups: essential and important. More requirements are imposed upon the former group. In general, the demarcation between the two groups is done by relying on the concept of criticality, which in the NIS2’s Article 2 mostly refers to “critical societal or economic activities”. With this concept, eleven sectors of high criticality are listed in the directive’s Annex I. These include traditional critical infrastructure sectors, such as the energy and transport sectors, as well as banking, healthcare, and central government administration. In addition, Annex II provides a further listing of other critical sectors, including postal services, waste management, research institutions, and providers of digital services, whether online marketplaces or search engines. Already these exhaustive listings make the NIS2 directive highly relevant for the research domain investigating critical infrastructures.

Many reviews (e.g., Mikac,, 2023) have already been published about the NIS2 directive and its relation to critical infrastructure protection in Europe. However, thus far, a review has been lacking about the research addressing NIS2 either explicitly or implicitly. Against this backdrop, the paper presents a systematic literature review (SLR) about NIS2-related research. The goal is thus not a comprehensive review of the NIS2 directive itself—instead, the motivation and focus are on the aspects existing research have considered relevant or interesting about the directive, and on which particular contexts the directive has been discussed in the academic literature. On these notes, Section 2 elaborates the SLR approach used for retrieving the literature. Then, the review is presented in Section 3 after which the conclusion follows in Section 4.

The search procedure for the SLR was simple: the databases of six scientific publishers were queried with a string “NIS2 AND directive”, where AND is a Boolean operator. The word directive was necessary because the acronym NIS2 refers to other things in biomedical and related sciences. With two exceptions, the searches were restricted to abstracts. The first exception is the Elsevier’s ScienceDirect database for which a search was restricted to abstracts, titles, and keywords supplied by authors. The second exception is the Springer’s database that does not allow searches to be restricted to specific elements in publications. For this database, “NIS2 directive” (with the quotation marks) was used as a search term. With respect to SLRs in general, these two exceptions demonstrate that the long-lasting problem with publishers’ databases is still present (Kitchenham et al.,, 2009). Then, regarding the other crucial factor in SLRs, the exclusion criteria, publications were only qualified insofar as they (1) were peer reviewed, (2) were written in English, and (3) discussed the NIS2 directive explicitly with more than three sentences. The last exclusion criterion ensured that publications merely mentioning the NIS2 directive in passing did not enter into the sample.

As can be seen from the illustration in Fig. 1, the final sample contains $37$ publications. Most of these were published by Springer. Conventional scientific articles and publications in peer reviewed conference proceedings are the most common publication types, although the sample contains also a few monographs and edited collections.

The reason for the relatively small amount of papers is likely partially explained by the fact that NIS2 is still rather new. This point manifests itself also in that all publications sampled are relatively new; the majority was published in 2024. Although the deadline for national transpositions of the NIS2 directive was in October 2024, as specified in the NIS2’s Article 41, the implementation work continues also thereafter. For instance, the deadline for the member states to identify their critical entities is in April 2025 according to Article 3(3). Already these deadlines and other schedules imply that practical evaluation research is missing from the sample. While critical reflections have been published, it is understood in the literature that evaluations can only be done after the directive has been operational for a sufficient amount of time (Ruohonen,, 2024). Against this backdrop, it seems fair to assume that in the future also evaluation work will be published, whether the work is about legal analyses of national adaptations, administration and enforcement, or the actual cyber security impact. In any case, the little below forty papers avoids the common feasibility (Kitchenham et al.,, 2009), or breadth and depth (Fisch and Block,, 2018), obstacles often encountered in SLRs.

The review of the $37$ publications is presented by focusing on two broad themes: the framing presented in the publications with respect to other EU laws and the EU’s jurisprudence in general, and the technological or other application contexts the publications have focused on. The former theme is important because it helps to understand how the publications have generally understood and approached the EU’s cyber security governance framework. It is also important because the sample contains legal scholarship too. Then, the second theme is relevant because it allows to understand the contexts academic research has considered relevant or interesting in terms of the NIS2 directive. Both themes are also relevant regarding the common rationale behind SLRs, the examination whether there are notable gaps in existing knowledge. Before continuing, a remark about presentation should be made: because the review mixes also a few relevant publications that are not part of the actual sample, the publications belonging to the SLR per se are enumerated and identified in two tables soon presented.

The paper presented a systematic literature review on the new NIS2 directive. The directive is an important part in the EU’s regulatory cyber security framework. It addresses particularly the cyber security of critical infrastructures in Europe. According to the review presented, the increased complexity and regulatory fragmentation are visible also in the literature in a sense that many publications have framed and discussed the NIS2 directive in relation to numerous other EU laws. It seems reasonable to conclude that the overall judicial crux will motivate further work for years to come.

The publications reviewed have also discussed the NIS2 directive in various different contexts. Among these are traditional critical infrastructure contexts, such as those related to the energy and water sectors, industrial control and SCADA systems, and telecommunications. Many publications have also sought to design and develop new infrastructures and platforms for better information sharing and situational awareness. In addition, various technologies, whether IoT devices, AI, smart cities, or digital twins, have been discussed in relation to NIS2 alongside standards and miscellaneous cyber security topics. Given the eleven critical sectors considered in the NIS2 and CER directives, it seems again safe to assume that these sectors will motivate a lot of further work concentrating on particular contexts. For instance, to put aside an odd publication dealing with satellite communications, none of the publications reviewed discussed space technologies, which are certainly an interesting contextual area to study also from a cyber security perspective in the future. Nor was there a publication in the sample that would have focused on public administration as a critical entity.

In addition to these concluding remarks, six points can be raised about research gaps and topical areas that would require or benefit from further work. These six points should not be taken to imply that there would not be more; the NIS2 directive is a comprehensive law that likely opens also other further research possibilities.

First, it is worth revisiting the argument about the NIS and CER directives having expanded the scope of critical infrastructures. Both legal and more theoretical further research is warranted in this regard. A generic problem with expansions is well-recognized in the academic literature; terms such as conceptual expansion (Spinuzzi,, 2011) and conceptual stretching (Ruohonen,, 2021) have been used to elaborate the dangers involved with enlarged definitions; once almost everything belongs to a definition or a theoretical concept, the definition or concept starts to lose its qualifying characteristics. In other words: if almost everything is seen as critical, then not much is available to demarcate non-critical entities from critical entities. Here, the problem’s kernel can be seen to originate from the concept of criticality, and the EU and its regulations are far from being the only ones facing the problem (Ruohonen et al.,, 2024). As was discussed, further theoretically oriented work is required particularly regarding the EU’s traditional sectoral definition for critical infrastructures and its relation to the new digital infrastructure category present in the CER and NIS2 directives.

Second, it seems sensible to argue that risk management would deserve further contributions too in the NIS2 context. Although there is plenty of existing work in this area with respect to standards and technical solutions, the NIS2’s whole scope has not been addressed. In particular, the directive’s Article 21(2) mandates “an all-hazards approach” covering ten distinct risk management areas. These include traditional areas, such as risk analysis, incident handling, vulnerability coordination and disclosure, but also supply chain security, so-called cyber hygiene practices, authentication, encryption, human resources security, and even business continuity should be covered. Of these areas, supply chain risk management is particularly interesting as it is directly related to the interconnectedness problem and cascading failures (Sanders,, 2023). The all-hazards approach envisioned would also benefit from further work investigating and modeling how risks in the different areas are potentially connected to each other.

Third, none of the studies captured by the SLR protocol addressed or even discussed the databases and registries established and mandated by the NIS2 directive. Although only time will tell how these will function and what impact they will have, these can be seen as an important part of the directive in many ways. Thus, to begin with, the NIS2’s Article 12(2) introduces a new European vulnerability database. Once established and functional, this database requires evaluations and assessments already because of the well-known problems that have plagued vulnerability databases in general (Anwar et al.,, 2022; Nguyen and Massacci,, 2013). There are also opportunities for further work regarding potential international cooperation, interoperability between vulnerability databases, new vulnerability concepts brought by the CRA, and the effects of these upon vulnerability disclosure, coordination, and mitigation (Ruohonen and Timmers,, 2024). Then, to proceed, Article 27 in the NIS2 directive mandates registrations from all entities belonging to the digital infrastructure category to a centralized database managed at the EU-level. In addition to basic information, such as contact details, the entities must supply their Internet protocol address ranges. Furthermore, the subsequent Article 28 in the directive seeks to improve the security, stability, and resilience of the DNS by mandating the member states to collect registration data from not only TLD name registries but also from all conventional domain name registrations. Given the importance of domain name registration data in analyzing cyber attacks and resolving cyber crimes (Maroofi et al.,, 2020; Shi et al.,, 2018), this new obligation can be seen as particularly relevant in the NIS2’s database context.

Fourth, many of the publications reviewed operated in a context involving new technologies. In this context, it is worth recalling the publication that designed data collection from legacy systems. The reason is that many critical infrastructures either are legacy systems themselves or depend on legacy systems, which may increase cyber security risks and typically constrain the adoption of new technologies, including AI solutions (Hurst and Shone,, 2024; Maglaras et al.,, 2018). This point should not be taken as an explicit criticism about the publications reviewed themselves. Instead, it is more about the NIS2 directive itself, which, in its recitals 51 and 89, encourages the member states to adopt innovative technologies, including AI, to tackle cyber security threats, including with respect to critical infrastructure protection. Given such an encouragement, further research is required about the presumably difficult interplay between critical infrastructures, legacy systems, and new technologies.

Fifth, many publications reviewed also designed and envisioned large-scale information sharing and situational awareness infrastructures. In addition to the previous point, it is worth remarking the potential practical obstacles constraining the adoption and deployment of such infrastructures. There is a good reason for this remark: despite some progress, technical obstacles, including those related to standardization and interoperability, trust, and other related factors have constrained the sharing of cyber security information throughout the world (Ruohonen,, 2024; Skopik et al.,, 2016; Zibak and Simpson,, 2019). Further research is required about such obstacles potentially affecting the NIS2’s implementation particularly with respect to union-wide, pan-European information sharing and associated critical infrastructure protection.

Last, it is worth returning to the evaluation research already noted. While it is impossible to envision which particular areas will be especially relevant for evaluations, administration and enforcement are always relevant in the context of regulations. To this end, it seems again sensible to argue that the increased legal complexity and fragmentation will be felt also among public administrations, whether national or European. Administrative efficiency would thus likely offer a plausible research topic, whether examined by the means of surveys or interviews. Analogously to the GDPR’s administration and enforcement (Ruohonen and Hjerppe,, 2022), an alternative path would involve examining future administrative fines and other penalties from non-compliance. Here, it is worth mentioning that both the NIS2 directive and the CRA regulation entail potentially severe financial consequences from non-compliance. While fines, penalties, and non-compliance in general are essentially a negative way to approach regulations—nothing is said about compliance and good practices in general, they might still in the future reveal some particular bottlenecks potentially affecting the private sector operators of the Europe’s critical infrastructures. With these points in mind, further work, perhaps in a form of university-industry collaborations, is required on the means by which compliance can be reasonably gained and proved.