NIS2 Finland: what you need to know about compliance and certification

What does this mean for my company?

1. Registration

The supervisory authority must maintain a list of essential and important entities under its jurisdiction. If your organisation falls within the scope of the Finnish Cybersecurity Act, you must register your organisation with the relevant supervisory authority before 8 May 2025. If your organisation operates in multiple sectors, you must register with the supervisory authority for each sector. Each authority has its own registration procedure. The registration requirement applies to all entities covered by the NIS2 regulatory framework.

Entities must provide the relevant authority(ies) with the following information:

• Name of the entity
• Address, email address, telephone number and other contact details
• IP address range
• Sector and subsector
• Classification of the entity
• List of Member States where the entity provides services covered by NIS2
• Information on participation in voluntary arrangements for sharing cybersecurity information

Any changes to the above information must be reported immediately and within two weeks of the change.

Entities falling within Traficom’s area of competence can register via the online platform. Each authority has its own online platform, if already available, on which the entity can register.

2. Control measures (Art. 9)

If your organisation is categorised as an essential or important entity, this means that you are responsible for implementing appropriate technical and organisational measures to ensure the security of your network and information systems. These cybersecurity management measures include at least:

• Policies and procedures to assess the effectiveness of measures for managing cybersecurity risks
• Policies for risk analysis and security of communication networks and information systems
• Security when acquiring, developing and maintaining network and information systems, including response to and disclosure of vulnerabilities
• Supply chain security
• Security aspects of asset management
• Security aspects relating to personnel, cyber hygiene and cyber security training
• Security aspects relating to access policy and authentication procedures
• Policy and procedures on cryptography and, where applicable, encryption
• Incident management
• Business continuity and crisis management and, where necessary, the use of secure backup systems
• Information security measures to ensure the security of business operations, telecommunications, hardware, software and data sets
• Measures to ensure the security of the physical environment and facilities of communication networks and information systems and the necessary resources

In Implementing Regulation 2024/2690, the European Commission has elaborated the above minimum measures for cyber security for DNS service providers, top-level domain name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplace providers, online search engines and social networking service providers, and trust service providers.

More information on management measures can be found here.

3. Reporting obligation for significant incidents

Important and essential entities are required to notify the supervisory authorities when a significant incident occurs. In addition, they must also notify the recipients of their services if the significant incident affects the provision of services in the (sub)sectors listed in Annexes I and II.

A significant incident is defined in the NIS2 Act as ‘any incident that has significant consequences for the provision of one of the services in the sectors or subsectors listed in Annexes I and II of the Act and that:

• has caused or is likely to cause a serious operational disruption of one of the services in the sectors or subsectors listed in Annexes I and II or financial losses for the entity concerned; or
• has affected or is likely to affect other natural or legal persons by causing significant material or non-material damage’.

The significant incident shall be reported by the essential and important entity via Traficom’s e-service in accordance with the following procedure:

1. Immediately and within 24 hours of becoming aware of the significant incident, the entity shall submit an early warning, indicating the probable cause and any cross-border implications;
2. Immediately and within 72 hours of becoming aware of the significant incident, the entity shall communicate an incident report containing an information update and an initial assessment of the incident;
3. At the request of the competent CSIRT, the entity shall submit an interim report;
4. No later than 1 month after the incident report, the entity shall submit a final report stating:
   1. A detailed description of the incident, as well as its severity and consequences;
   2. The type of threat or root cause that is likely to have led to the incident;
   3. Risk mitigation measures applied and ongoing;
   4. The cross-border consequences of the incident, if applicable.
5. If the incident is still ongoing one month after the incident report, the entity shall submit a progress report and a final report shall be submitted within one month of the incident being resolved.

The European Commission has laid down the criteria for a significant incident for DNS service providers, top-level domain name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplace providers, online search engines and social networking service providers, and trust service providers in the Implementing Regulation 2024/2690. These special rules take precedence over national rules in the event of any conflict.

Finally, all entities, regardless of whether they fall within the scope of the NIS2 Act, can voluntarily report (significant) incidents, cyber threats and near misses via the e-service.

More information about incident reporting can be found here.

4. Obligations and responsibilities of management (Art. 10)

The management bodies of essential and important entities are responsible for compliance with the cybersecurity law and must fulfil various obligations, including:

• Approving the cybersecurity management measures
• Following training to acquire sufficient knowledge and skills to identify risks and assess management measures and their impact on their services
• Continuously training the employees of the cybersecurity entity in the field of cybersecurity

The management bodies are liable for non-compliance with the NIS2 Act.

5. Cooperation with authorities

Essential and important entities must cooperate with the national authorities. This concerns the exchange of information on the security of network and information systems, reporting incidents, cooperation with the inspection service, etc.