Cybersecurity Act 2024
Decentralized supervision framework with Traficom overseeing digital infrastructure. Implements risk management requirements for critical entities while aligning with DORA for financial sectors.
| Jurisdiction | Finland |
|---|---|
| Category | Cybersecurity |
| Status | Active |
| Latest development |
Analysis
Key Requirements
The Cybersecurity Act 2024 introduces several key requirements for organizations:
- Risk-based cybersecurity management: Entities must conduct risk assessments and implement appropriate measures to mitigate identified risks. This approach aligns with the EU NIS2 Directive implementation in Finland.
- Incident reporting: Critical entities are required to notify both the Chief Executive and their sector lead of any cybersecurity incidents or potential threats affecting their infrastructure, as outlined in the Finnish Government's proposal.
- Compliance with sector-specific codes of practice: NCII entities must implement cybersecurity measures, standards, and processes specified in the code of practice for their sector, as detailed by the Finnish Transport and Communications Agency (Traficom).
- Regular audits and assessments: Organizations are required to conduct cybersecurity risk assessments and undergo audits by approved auditors to ensure compliance with the Act and relevant codes of practice, as specified in the Cybersecurity Act implementation guidelines.
Compliance Challenges
Organizations face several challenges in complying with the Cybersecurity Act 2024:
- Resource constraints: Many organizations, especially in the privacy sector, are struggling with underfunded and understaffed programs, according to ISACA research.
- Legacy systems integration: Adapting older IT infrastructure to meet new cybersecurity requirements can be complex and costly, as highlighted in a Deloitte cybersecurity report.
- Multi-sector compliance: Organizations operating across multiple sectors may face challenges in complying with different sector-specific requirements, as noted in the Finnish Government's implementation plan.
Implementation Best Practices
To effectively implement the Cybersecurity Act 2024 requirements:
- Conduct a comprehensive risk assessment using frameworks like NIST Cybersecurity Framework or ISO 27001.
- Develop and maintain an incident response plan, following guidelines from ENISA.
- Implement a zero trust architecture to improve resilience and response capabilities, as recommended by the National Cyber Security Centre Finland.
- Regularly train employees on cybersecurity best practices using resources from Cybersecurity and Infrastructure Security Agency (CISA).
Recent Updates
Recent changes to the Cybersecurity Act 2024 include:
- The Finnish Government submitted the proposal for implementing the EU NIS2 Directive on May 23, 2024, with requirements expected to become applicable on October 18, 2024.
- Covered entities must submit their information to the registry by December 31, 2024, as stated in the official implementation timeline.
Related Regulations
The Cybersecurity Act 2024 interacts with several related regulations:
- EU NIS2 Directive: The Act implements this directive in Finland, expanding cybersecurity requirements across critical sectors. Full text of NIS2 Directive
- DORA (Digital Operational Resilience Act): Complements the Cybersecurity Act for financial sector entities from January 17, 2025.
- EU AI Act: Introduces new compliance requirements for AI systems, intersecting with cybersecurity concerns. EU AI Act overview
Industry Impact
The Cybersecurity Act 2024 significantly impacts various industries:
- Healthcare: The Act promotes adoption of cybersecurity best practices across the healthcare and public health sector, as outlined in the White House National Cybersecurity Strategy Implementation Plan.
- Energy sector: New requirements for secure development and manufacturing of semiconductors and cybersecurity principles for electric distribution are introduced, according to the Implementation Plan.
- Digital infrastructure: Traficom will supervise digital infrastructure entities, potentially leading to increased compliance costs and operational changes, as detailed in the Finnish Government's proposal.
Sources
- EU NIS2 Directive
- Finnish Government's Cybersecurity Act Proposal
- Traficom Cybersecurity Information
- Cybersecurity Act Implementation Guidelines
- ISACA Research on Privacy Programs
- Deloitte Cybersecurity Report
- Finnish Cyber Security Strategy Implementation Plan
- NIST Cybersecurity Framework
- ISO 27001 Standard
- ENISA Incident Response Guidelines
- National Cyber Security Centre Finland
- CISA Cybersecurity Training Resources
- NIS2 Directive Implementation in Finland
- Government Proposal on EU NIS2 Implementation
- NIS2 Directive Full Text
- DORA Overview
- EU AI Act Overview
- White House National Cybersecurity Strategy Implementation Plan
Recent developments
- — European Commission publishes proposal for a comprehensive **revision of the EU Cybersecurity Act**, aiming to simplify and streamline the EU cybersecurity regulatory framework, strengthen ENISA’s mandate, and introduce a mandatory ICT supply‑chain framework for high‑risk vendors.[2][6] (source)
- — Commission announces a new **cybersecurity package** including proposed amendments to the NIS2 Directive and a revised Cybersecurity Act to reduce regulatory duplication, simplify compliance, and improve coordination of ransomware data collection and supervision of cross‑border entities.[6] (source)
- — The **Cyber Solidarity Act** enters into force, establishing EU‑level alert, emergency, and reserve mechanisms that rely on certified capabilities and cooperation structures influenced by the Cybersecurity Act’s framework, impacting incident‑response providers and managed security service markets across the EU.[3][6] (source)
- — EU adopts a **targeted amendment to the Cybersecurity Act** extending the EU‑wide cybersecurity certification framework to *managed security services*, enabling future European certification schemes for these services.[6][2] (source)
- — The **Cyber Resilience Act** enters into force, introducing lifecycle cybersecurity requirements and incident‑reporting obligations for products with digital elements, which interact closely with the existing Cybersecurity Act’s certification framework and NIS2 obligations for providers.[1][4][6] (source)
- — Council of the EU adopts a **targeted amendment to the Cybersecurity Act** as part of a wider cybersecurity package, enhancing EU cyber resilience by enabling certification schemes for managed security services and complementing the new Cyber Solidarity Act.[3] (source)
- — Australia enacts a national **Cyber Security Act 2024**, imposing mandatory security standards on internet‑connectable products and ransomware‑payment reporting duties—seen by industry as broadly aligned in spirit with the EU Cybersecurity Act and CRA, raising global compliance and product‑security expectations.[5] (source)
- — Deadline for EU Member States to transpose **NIS2** into national law passes, triggering enforcement of updated cybersecurity rules that interact with the Cybersecurity Act’s certification schemes and the CRA’s product requirements, prompting companies to reassess cyber‑risk management and compliance strategies.[4][6] (source)
- — EU cybersecurity policy overview highlights that NIS2 implementation, the Cybersecurity Act (including its amendment), and the CRA together form a consolidated regulatory framework, pushing cybersecurity service providers and product manufacturers to invest in compliance, secure‑by‑design engineering, and formal certification.[6][4] (source)
- — Council presidency and European Parliament negotiators reach a **provisional agreement** on a targeted amendment to the Cybersecurity Act to enable certification schemes for managed security services, with industry anticipating new certification opportunities but also additional assurance and audit obligations.[2] (source)
Related regulations
- NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
- Law on Cybersecurity of Vietnam — Vietnam, Active
- Austria NIS2 Act — Austria, Upcoming
- Luxembourg NIS2 Transposition — Luxembourg, Active
- EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
- EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
- Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15
- Belgium NIS2 Transposition — Belgium, Active, effective 2024-10-18
Put it into practice
- Generate the policy: NIST CSF policy generator (generatepolicy.com)
- Buy the policy pack: Enterprise Security Bundle (cyberpolicy.shop)
- Build it yourself: Compliance Program Starter (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates