Cybersecurity of Essential Services : On the proposal for a new Euro- pean regulation on high security in systems with societal and economic importance

The EU Parliament has passed the proposal for a revised cybersecurity measures directive (NIS2) which will come into effect in late 2022 or early 2023. The reg- ulation aims to enhance the protection of network and information systems of services that are essential to maintain critical societal and economic activities. But such aims encompass further regulation for those who offer such essential ser- vices that result in obligations to implement measures within the organization to ensure that these cybersecurity measures are in accordance with the regulation. The purpose of this thesis is thus to examine and analyze if the NIS2 regula- tion will prove efficient protection of network and information systems of essen- tial services. A technical perspective is applied to investigate what cybersecurity is, but it is also examined in a legal perspective, to determine what cybersecurity means in a legal context. What cybersecurity is and how it can be protected in NIS2 are analyzed through the method of legal dogmatics, as well as the EU legal method and the method of legal informatics. The investigation results in a definition of what cybersecurity encompasses as both a legal and a technical term. Based on this definition, the study then exam- ines NIS2 and compares it to the current legislation, both in an EU context and a Swedish context in order to assess the efficiency of the directive. This is done by breaking up main points of the NIS2 into different problem areas and inves- tigating the possible consequences of the regulations and seeing if these conse- quences can lead to a higher compliance with the directive. Since the de lege lata part of the essay points to a number of issues with the efficiency of the NIS2, the thesis analyses these issues and discusses possible de lege ferenda solutions to these problems.