Finland NIS2 Strategy

Nordic approach emphasizing public-private partnerships and Arctic infrastructure protection.

Analysis

Organizations must identify, assess, and manage cybersecurity risks affecting communication networks and information systems, with measures that are timely, proportionate, and adequate, considering factors like scope of operations, incident impacts, and available technical possibilities, as outlined in §9 of the Finnish Cybersecurity Act.Finland's Cybersecurity Act details Traficom risk management recommendation
Establish and maintain an up-to-date cybersecurity risk management policy per §8, adopting an all-hazards approach that covers networks, systems, physical environments, and defines objectives, procedures, responsibilities, plus 12 specific measures like asset management, personnel training, and supplier security.OpenKRITIS Finland NIS2 page Copla NIS2 Finland implementation
Register with the supervisory authority by December 31, 2024 (or September 30, 2025 per some sources), providing details like contact info, IP ranges, and sector, with changes reported within two weeks under §41 and §47.OpenKRITIS registration obligations ISMS.online Finland NIS2 Traficom cybersecurity info
Comply with incident reporting and penalties aligned with NIS2: up to €10M or 2% global turnover for essential entities, €7M or 1.4% for others under §38.Copla compliance deadlines EU Digital Strategy NIS2 Finland

Broadened scope from ~1,100 to ~5,500 entities, including mid-sized manufacturers and municipalities over 50,000 residents, overwhelming smaller organizations without size distinctions in obligations.Copla scope expansion Dittmar NIS2 implementation news
Dual regulatory overlaps, such as finance sector facing DORA alongside NIS2 for reporting, penetration testing, and ICT assessments, leading to conflicting timelines and resources.Copla industry challenges ISMS.online authority sharing
Executive accountability and vendor management for digital providers, requiring 24/7 SOC and supplier registries even for small entities, as seen in cases of mid-sized MSPs struggling with real-time monitoring post-2025 enforcement.Copla pro tips on monitoring Fimea supervision challenges

Conduct a gap analysis against §8-9 risk measures, prioritizing all-hazards policies, asset identification, and training; use Traficom's baseline hygiene practices from Article 21.Traficom recommendation PDF OpenKRITIS risk policy guide
Appoint a CISO and register promptly by 2025 deadlines, mapping workflows to NCSC-FI controls for essential/important tiers with turnkey tools like Copla for reporting ladders.Copla workflows Traficom NIS2 package
Implement 24/7 monitoring and supplier registries for digital infrastructure, leveraging standards/references in justifications and tools for maturity assessment per supervisory guidelines.OpenKRITIS tools section ISMS.online compliance steps

Cybersecurity Act 124/2025 entered force on April 8, 2025, replacing NIS-1 and integrating CER aspects, with entity registration by September 30, 2025, and full compliance for essentials by March 31, 2026.Fimea Act entry Copla timeline
EU Commission issued reasoned opinion on May 7, 2025, for incomplete transposition notification, amid broader infringement on 23 states post-October 2024 deadline.EU Digital Strategy status ECSO transposition tracker
Law approved post-2024 consultations, amending multiple acts without mandatory audits but allowing post-incident requirements under §30.OpenKRITIS status update Dittmar news on approval

DORA (Digital Operational Resilience Act) overlaps in finance with dual reporting, penetration testing, and ICT assessments, requiring integrated compliance for banks and insurers.Copla DORA interaction EU NIS2 Directive official
CER Directive integrated into Cybersecurity Act for critical entity resilience, expanding physical protections alongside NIS2's cyber focus.Copla CER integration ECSO tracker on CER-NIS2
NIS1 remnants fully replaced, but sector-specific rules from Traficom/Fimea continue for baseline hygiene under Article 21.Traficom NIS2 info ISMS.online prior NIS

Cybersecurity and ICT sectors face expanded obligations for ~5,500 entities, boosting resilience but increasing costs for mid-sized firms and digital providers like cloud/DNS with mandatory monitoring.Copla industry scope Dittmar medium entities
Public administration and municipalities (>50k residents) must appoint CISOs and adopt baselines, straining resources while enhancing Arctic/Nordic infrastructure protection via public-private ties.Copla public admin Fimea supervision
Finance and manufacturing see heightened vendor scrutiny and reporting, with studies noting shift to systemic resilience amid rising threats.ISMS.online impacts ECSO EU-wide effects

2026-03-31 — Full compliance deadline for essential entities under NIS2 Cybersecurity Act 124/2025, emphasizing 24/7 monitoring, incident reporting, and ISO 27001 fast-tracks[1]. (source)
2026-01-16 — Finland among European states facing delays in full NIS2 adoption and implementation, with ongoing transposition challenges noted[7]. (source)
2025-12-01 — Revised Finnish Cyber Security Strategy to 2035 integrates NIS2 requirements into comprehensive security, with implementation plan completed in December 2024[4]. (source)

NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
Law on Cybersecurity of Vietnam — Vietnam, Active
Austria NIS2 Act — Austria, Upcoming
Luxembourg NIS2 Transposition — Luxembourg, Active
EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15
Belgium NIS2 Transposition — Belgium, Active, effective 2024-10-18